5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454

Sharing

Copy URL Twitter E-mail

General

Target
5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454
Size 96.3MB
Sample260831-ffdsjsxtgv
SHA256 5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454
MD5 472373ebc24873bd47ff38e5f4a59099
SHA1 99e6b348e8814e8551d7ae5097aed76e6e5f08ef
SHA512 c496bb4576e261d33ab09195561473d61451c5de55c886c4aa84373abde0bf67ff45f8654210ce8b420db130ca42cc29f90fd7fbdb86e3771c2ba430741d8b31
SSDEEP 1572864:ZYxcfesquEqemJH9GIlFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JG4km7:6qesA6d3TKkoAPxkIIaJG477
TLSH
T16D2833D61FB0C919C5D6BE331292BCE7223C83437B82846D4AD6325309FCA797F595A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454
- Size 96.3MB
- SHA256 5c23845f6923c73ba27f1bfc20918ab9c9fd4131cd8e1b7b0ab5d8d60a016454
- MD5 472373ebc24873bd47ff38e5f4a59099
- SHA1 99e6b348e8814e8551d7ae5097aed76e6e5f08ef
- SHA512 c496bb4576e261d33ab09195561473d61451c5de55c886c4aa84373abde0bf67ff45f8654210ce8b420db130ca42cc29f90fd7fbdb86e3771c2ba430741d8b31
- SSDEEP 1572864:ZYxcfesquEqemJH9GIlFKT4foTuwwwXYPDwmjA8d+5ZW1e/W5JG4km7:6qesA6d3TKkoAPxkIIaJG477
- TLSH
  T16D2833D61FB0C919C5D6BE331292BCE7223C83437B82846D4AD6325309FCA797F595A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH
  T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 6f02237496ce3d04459539c530521e6ae2aa05dc6e3f669769898e604b8d5dd7
- MD5 36ed84518cec417689c14a0a6b5bb45f
- SHA1 9815663b6d9c2d38b322f5e2c9f7c6ea80adaa52
- SHA512 27cc09be5b9975400add2d054647d430baa1c2e512322b45fb52d3e18b9951191aa77aea11eed66c031b698958477c3e7f48f0f8ba7b592d2bfe669909e0f62d
- SSDEEP 196608:Z+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKqvU:Z+kNf+BWWyUA4Qjnw6+RsKqv
- TLSH
  T1BD4729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 e8ef0c488acde7242b318b7babf6e45297a57ec968abd700f989d6269bf36831
- MD5 beb482ccc819f4112eb44714bc278f6a
- SHA1 715f27372653097510a2a2a7b9d39faeadf5e67d
- SHA512 71c85a14d4135f606ae077c85f294d53140b33a078ec00415dd780a68fe607b81039e0a3b283502556d4cc148204dfe8bc378288978f73fc1d5f5ac50eca0077
- SSDEEP 49152:2ESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGH:2DaTSEYht8OnZGNxcO6IhgiS9Nol7Wtu
- TLSH
  T1F1E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  gate.exe
- Size 201.1MB
- SHA256 8007db4252a3ba0858e41007dad9d6b3758e5ccb155c31420e717c226e038126
- MD5 bd52c5b623120ec00e484c6dc5b22f0c
- SHA1 4929f636f8d4e993c11daf2314e844e2321a1c89
- SHA512 4b24d1924b53926dd2a502bfe0e2cb40e154460e0a76951adb49b1946ee7c70824aaaf123b7a03d9c1f8810a30b45915d3f8dc96de8eb253a2731cf68d318768
- SSDEEP 1572864:khMtgUaQTwtGgBcarGuvmXekc+QbYK+vdEFT6/0qxf/9SFnucpLDCqMyvJZmD+Je:F65VTcDFnNt
- TLSH
  T118A87B03E29601E9E05DD1759B5A9633FEB1B8094724A3DF2B5407522F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral13
- Target
  libEGL.dll
- Size 492KB
- SHA256 cc90ee15962abb35fcc409b854de08b2e640b5aa44c9211be3eafca43917074b
- MD5 c929717c349759a1f94e25927ded50f0
- SHA1 5adf39da408d8295811c9e08ce9147e37b9099ad
- SHA512 79fe838e0fda944dbf299fc6f3b4b66a3ec2bb7e7640c607b012b04bbd7cb3fc8a526edfb4d403c0c96044f62e77d401517063d6a5c69197dbe03be925ab960c
- SSDEEP 6144:wtqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoS/hg:qqwvC8SrZmNEIsPwa6R3/8cWqt0HoSa
- TLSH
  T1EDB49D15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 273e0c34c3511fa793eb8c7a30623218c530c01668640d890a70d8c77a5a9466
- MD5 bfc79aba42f0b047f07ab43e9b53370b
- SHA1 b14e2557f1c50a9e670f66b7e2eba55189b92d9e
- SHA512 4aa36093fb2bbcd7a88aa463d1381fea6e264f3d0e1071a1c8772c63827191a3b6c1788bfd513bf0f81539654afde0fa51ebe1448b9899425720afaa8ca3473b
- SSDEEP 49152:Qh+XpQjxg3kJXrCtf/EbJ2npdfPHn7VHe1yTveomnSfb+5LDrpRXJDysxrY0U5Aj:ALMXVv/f+vplJLdPCuAYT7tc3j38
- TLSH
  T149867C03F69581D8C05DE2B8975B9227FA31B8490734B6CF2AA413152F6BFE0A77E354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.8MB
- SHA256 b938d698f0302c35004025528c99ea14b0f04c8849d3a1e89cf6c2f9055eae1e
- MD5 4d8cf7477ff2fccaff447831685879a3
- SHA1 48b1e10edb8d9ad26ac00af0f09ee76857ce8cc0
- SHA512 0128c18058d7f7feaa4421fe5b7b54f14e42f2c86e8447214e87228afa5e699bff33153bc5ee0ece2d5228801a22d8c8beebf1f933cd53dd65656eb2b3a6167b
- SSDEEP 49152:R6r0hfi1w9hxuN36Wqd1SJfZNYqKcAwf0k9lCLpsLae:RXhfi1wduN36WqPSJfzf
- TLSH
  T1C3958C4BE2B400FDC1A7C0B9851B160BE7B6B40517749BDB1594CA6A6F23FE217BE324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
- MD5 722c2b2dbeee143a14c7ba04edf8e3f7
- SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
- SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
- TLSH
  T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 dd195036c9b7e7fb420c7e9ee118b33a9be9a5e61266f66663cf7f14b9844257
- MD5 99d9da809fabafaa59d59bb7cdffd744
- SHA1 0f90eddd4b143c59cd9bd5c5b89468ddbd8b2431
- SHA512 4e1961e1621e0d04be14c9c32c60d7825063f64b59fe4f747ebdfc4f76319c59e1e1e1c20e1b957a790f83f37c389212b4aea458da7b450bd64abe67b2a95f58
- TLSH
  T17B8161F76789067D24C70029A12D61CABA23C32F8B7478484089566C0530AE45FBACFF
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution antivm
- Executes dropped EXE
behavioral20 behavioral21 behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
- MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
- SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
- SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
- SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
- TLSH
  T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
- MD5 26660b3078523a953ee252b4e86e1c8b
- SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
- SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
- TLSH
  T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
- MD5 25fdd950809b2b22d0ba6917fe014c35
- SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
- SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
- TLSH
  T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
- MD5 69638dc10c19961a0c05350ae333d6a4
- SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
- SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
- TLSH
  T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
- MD5 1036ce624efbb9fbbb387fec25fd1bcb
- SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
- SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
- TLSH
  T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32