8be64ae7c43b8b8ae6c6621e72ff5ac82fc649aba349a7fc3ff1fa3980d1a861

Sharing

Copy URL Twitter E-mail

General

Target
Ether Ultimate Optimizer_6.8.7_x64-setup.exe
Size 8.2MB
Sample260831-c7rlyatepd
SHA256 8be64ae7c43b8b8ae6c6621e72ff5ac82fc649aba349a7fc3ff1fa3980d1a861
MD5 95edbdb12049e794e9c63066b71da0ed
SHA1 b14ded22b61d957f161f4f7af683ee824f295cdf
SHA512 8d4b91d097a6645b2d3fe49b56497704211303e0b615cce26893d176b81d84fa7321fb5940cc8b57eef62fc5b234f0a70cfe9e20b62f05ea75cb1ce4ecb5c0dc
SSDEEP 196608:nZb6ZrGtqknPa+g/RlDwv89KOxxZMOzztRT8jnl5N:nZb6Z291gplDUOxxb9RmX
TLSH
T1CD863388B69ACFBAC4107A3317F18B6E906718C718F1431B33D08B5B54B7AA82655F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Ether Ultimate Optimizer_6.8.7_x64-setup.exe
- Size 8.2MB
- SHA256 8be64ae7c43b8b8ae6c6621e72ff5ac82fc649aba349a7fc3ff1fa3980d1a861
- MD5 95edbdb12049e794e9c63066b71da0ed
- SHA1 b14ded22b61d957f161f4f7af683ee824f295cdf
- SHA512 8d4b91d097a6645b2d3fe49b56497704211303e0b615cce26893d176b81d84fa7321fb5940cc8b57eef62fc5b234f0a70cfe9e20b62f05ea75cb1ce4ecb5c0dc
- SSDEEP 196608:nZb6ZrGtqknPa+g/RlDwv89KOxxZMOzztRT8jnl5N:nZb6Z291gplDUOxxb9RmX
- TLSH
  T1CD863388B69ACFBAC4107A3317F18B6E906718C718F1431B33D08B5B54B7AA82655F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
- MD5 ee68463fed225c5c98d800bdbd205598
- SHA1 306364af624de3028e2078c4d8c234fa497bd723
- SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
- SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
- TLSH
  T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
- MD5 acde70f73d3b71b1c4222b763537780d
- SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
- SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
- SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
- TLSH
  T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  ether-ultimate-optimizer.exe
- Size 33.8MB
- SHA256 23c0feed1d99b679bdedcedc1c66592a014df3966717816f10738ff3cd067607
- MD5 0b92cce377df80f2a705ace863dcb339
- SHA1 6276acbda50619a757431b927c59c96b459cf840
- SHA512 0c9972bbc3ba0b8e8ae9029c961cf3028c8f3b167391c0ad1cae36033b95497ba5f475e2853908900c3218d77030bd2bea5c64635a68981dc0e263fa49f20744
- SSDEEP 196608:wfL5cUSi9DxawX/Zu0w2CRcUhJh4zZK1wlBoAS6YzY9hJKg2H:U5cbCLBunRcUjGl9S6YzY9hz
- TLSH
  T18977091DFA5A5B6CD05AC470824E4662DA31FACA8B3775BF74C472382F796F41A38234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral8
- Target
  icons/clean.png
- Size 2KB
- SHA256 aaaa08345f6faba4a0903343482940c9e161041c6ff4be88b18ff0dd78856555
- MD5 1c66751b525645e7e5533d3ecf1ded67
- SHA1 8676c5939e845c64471141aa959bfc61d1e2e0ce
- SHA512 169971fe87b75fd48cddf2a03f3e53b3295059cb7348226bfac7ec963371fc95a940173acb05846504401ac00624c6ee99cbf83555a4ec2976c4a981ebd54df8
- TLSH
  T1E5515CB00A1D4FE1C12BFE23721979ADD09700E71E45DE05C176A824FD2B9302EA967B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral9
- Target
  icons/exit.png
- Size 889B
- SHA256 1bfed0edf47e8056f88a3c66c5bd27a7a598f4b7c7776be41ef09e142db1968b
- MD5 9dbf340651e1766de5ec0dc78a46cd76
- SHA1 3d69bbf417e1c1730b949d8ff66ab3328ba3d4a0
- SHA512 823382e4ea94f10ad56adc6c38450ea622442e4c38a5cfcf70519e06acdd6da05529a92927318326cdc31613e77587c36f466024f5f0e7c0067b751859d074ea
- TLSH
  T19F1156C60581C7A4C151447944C718D3A2F7645DD39B459234979E33742DFF37901A92
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10
- Target
  icons/focus.png
- Size 1KB
- SHA256 2178865d07d0928f5870ee1bd70a536f360606c43e10cf62b707ced5cd942232
- MD5 128986eda899387e97168e43d425f776
- SHA1 cdf82fba41b69fb83c2796d4acd2bc3cafea5be5
- SHA512 e755e67b4c8d25fe88bb1fc50d8e3a0063171a795910114a1692e4a207429bf53f9584cdce8065219fd71d0b8ba6a6ac1d469107895a6ed36d1129c12e5b0ab3
- TLSH
  T16E412AC3478A2F6E851BF6D1485BA32CC4565AB9038CE390487126DBFCA24F75F8A04D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11
- Target
  icons/game.png
- Size 3KB
- SHA256 4ddaab8e6d24e2fd25f53cb985ad0d62e6d5e7f0fa40f3852bdd93414b9aceb2
- MD5 a55d020a3802645722ce9b53e3e35e23
- SHA1 c5d2163870b4a1d0c0b80df00ba68c8ce5597a13
- SHA512 547c21082c21fcb2e64d323d56607dbfe893eceace83b4622cdcbc084b9fe262afe0f08e08aa4bed1e88df122478b4b5b969b6fdf6a6f6bfa5ddbcdd9d16a07c
- TLSH
  T104515D8DE9903111A5B830909C77A8155960ECBF09FBBED3E7184D42BC59B71647C789
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral12
- Target
  icons/hide.png
- Size 1KB
- SHA256 22fcec214ab0e59ad2610bd12e5687289398a250623f66f6b9dae0a8c667e999
- MD5 4b461814e6c42fddc2976d8f28e90ca1
- SHA1 7a5286c7c6edb3c0b8160728574e4f5b2dcbdd4e
- SHA512 70c50dd4cfc1f0aae59016a40abc8bb814f62c300ad8b7fe20d4b0cccbc3b9c295e392a9d1ec09820cd725660d66e22a381875bf95758b50b60ef6b02f441c0c
- TLSH
  T1EF310CF9845438F131982726F49BB15030DE9C25511FD3E69CB785A5A64993C4A9A248
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  icons/open.ico
- Size 4KB
- SHA256 7b03e7638a02590df26e3c0ef8b5dca2eb8059a124b1f94ad122fdbd338406c7
- MD5 d7719863eb969b28a71e242f630d996f
- SHA1 1700a95c853aa9513a32a011936dab2d3b0d6e17
- SHA512 2faac37e0c5abf0b2c1c1c160dc4563ca33239b88e854f1365650b8607d965baeab1a27e7e574aafeb37aa5a05e295d122cf7fe704b1873afdeef04c48d97fcf
- SSDEEP 24:suySDC1qoy8BcyXbiUCJbww8Swkd3g68A1h/BKaZz6OhSzal:8SDC1qoDSynCFxGQQrA1h/BKaZz6Ohyi
- TLSH
  T1DB919A4274A6E866E08423B5DC83D2F2428E3E29DC534D47B1E47FAF7AB2E129B50418
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  icons/open.png
- Size 1KB
- SHA256 81999a4e8d3bcf9564090413dcaa166b38f8f762986a2e4b8d6917ec48f8804f
- MD5 dff7c2849c531eb3380be368e803866e
- SHA1 ce5d628fb22488e2b98f494c55ef15b31e4d8dea
- SHA512 12dc1c453ff3605ecf567099b18e14529838bbfa1c5a7fb81bbfcd15918e0372f14f16656f11785dd2327f43246d3f9af222267bd78a1e4ca372817fe0c73634
- TLSH
  T15231E9EE52A5DE2E0159960226AFC625CEE246490D7761EEC04A708CF20E6B45A4F871
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  icons/optimize.png
- Size 1KB
- SHA256 fd91e2d3c8112a088235d8a525b891606e2790961207b1db18c61264929fbe5d
- MD5 e153ad3ef66d2a004853d57128d23ebf
- SHA1 c123f5211da6d1fce4e251e347b4a3f435a2f6a9
- SHA512 d5c403ff2fb5cabccda36182fbb795f98a9b7bffd5da9cf041e655689eafadf9d0d034650d978492f8774ca57eeba8654c353dea83f72be2283662b2b108f1b6
- TLSH
  T16F31F7954801893998A244D2FD5305DDFD8B0DC250A2B0ED7916A683EC5DD36BA732A3
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral16
- Target
  icons/power.png
- Size 1KB
- SHA256 11291cbda9d747370ea39e7f5b48f6f2ef5bbfc3291a452a465361dc71138188
- MD5 79969b59a305f56fe7fd333c5fc769ed
- SHA1 26555c9cd917f9928f3c1e06db9aea712ad3a3f6
- SHA512 6a3129238a2ce14dc661814a756e88d193503b0f0c4c5c46c14acae61f5e916ea8ecaff3a9fa53f060fd551acbf1a22ad1c4196a81b772c1f0d84942fba2cfdb
- TLSH
  T15511E98C673991EAC58ABD50791B8310E42F2021F78357181083D9707F0EE903D2ABF5
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17
- Target
  uninstall.exe
- Size 77KB
- SHA256 53123ecb099642ff1f8e29180a866c7c98077fe43adcb730f71cd6acb9fb6815
- MD5 f3cdf19fb562cb465801761a73a49c29
- SHA1 6b6f78b884024ed5f6848325ba7fb55bf095e5b4
- SHA512 e43686e7d198d2dc846dc70eaccf6d88fcd5a353aa4b5a8dc40b93708d9a93aeee2130a50a93a5fca85e575e5f78bddb51037a9088ec6f6e93d2b0a6efe2d3a0
- SSDEEP 1536:tmsAYBdTU9fEAIS2PEtungdLeAyNxz77VPaUiefNDY8tr8zxPybtBP3mPXVoc:sfY/TU9fE9PEtunceA67Brv5VtbtBP2D
- TLSH
  T1F273CF017794C4B7D8B307319E7A97AB3FF9E52214A4971B13509B5DBA32280EE0E723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral18
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH
  T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
- MD5 acde70f73d3b71b1c4222b763537780d
- SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
- SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
- SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
- TLSH
  T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks installed software on the system

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Enumerates connected drives

Network Share Discovery

Power Settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21