aa0d9a5a921446a6a8beeb378f517409f5758b5231c84d9a8b9bd0bd04a41f0a

Sharing

Copy URL Twitter E-mail

General

Target
ExclusionVisualsInstaller.exe
Size 31.7MB
Sample260831-nde7lazhph
SHA256 aa0d9a5a921446a6a8beeb378f517409f5758b5231c84d9a8b9bd0bd04a41f0a
MD5 646b2c765b07b1a5397bc5c21facf87e
SHA1 0e27944e69bcbf79fcf88ba962ce5c0ebc867cf5
SHA512 dad1947410b929047f965f23139f605593ffa07306dfdf642089966df884af1ec4d363462bd6b36bc4a7e461663c4a0a453c29100cbc8417de6303df5eed02db
SSDEEP 786432:ROGmAwCdOVSAn523fs4LIH/W9C7J1hj9eXMTA3:ROewC0S0523fsU9uhj9wMTA3
TLSH
T17277330C237B4ECBD52ABBF1CFD78B381DBF4962A9078614DD3585815D9FE280C9612A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ExclusionVisualsInstaller.exe
- Size 31.7MB
- SHA256 aa0d9a5a921446a6a8beeb378f517409f5758b5231c84d9a8b9bd0bd04a41f0a
- MD5 646b2c765b07b1a5397bc5c21facf87e
- SHA1 0e27944e69bcbf79fcf88ba962ce5c0ebc867cf5
- SHA512 dad1947410b929047f965f23139f605593ffa07306dfdf642089966df884af1ec4d363462bd6b36bc4a7e461663c4a0a453c29100cbc8417de6303df5eed02db
- SSDEEP 786432:ROGmAwCdOVSAn523fs4LIH/W9C7J1hj9eXMTA3:ROewC0S0523fsU9uhj9wMTA3
- TLSH
  T17277330C237B4ECBD52ABBF1CFD78B381DBF4962A9078614DD3585815D9FE280C9612A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  app/qml/QtQuick/Controls/Basic/TableViewDelegate.qml
- Size 2KB
- SHA256 c23588e4d805bb6cef7c7c4ce15ea82a24141d1bb67a60a5ba208541ba8c87d3
- MD5 16a428af407e6c9ab7de26134144b7ba
- SHA1 fe4e70d8a0bd0806b9b95cc156b5e841c0381a7b
- SHA512 d51e5a1cd439ad52a234b1eb3218a930314a2e3048967a3350170edad3f062878527e7e47a57fe8ef054b7b93a8a0394abb92c1e4312c43b0623e6f32f908041
- TLSH
  T1DE517450E33227305078C35A7F57EC59DB05E603A6525117792C668C0FF05D1C2EBAEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  app/qml/QtQuick/Controls/Basic/impl/qtquickcontrols2basicstyleimplplugin.dll
- Size 29KB
- SHA256 d0f2a1438db1a4907248f6657a2d7de685f1586e954df32bc9c0a2da7b3f03ae
- MD5 43d5569fb48dd02567f78aa3316dc472
- SHA1 1eabdba01c0e9c114ade8a45055ef298033f9c93
- SHA512 96321def22a01f001a23beb23d400a544e62ecc597ef95f9ddc4d8d720cb806bdcc6077d05db432409f822135d2fceac0fdebb970962e1a3517b4b49f454d7c6
- SSDEEP 384:x+ScDrj74UqHvcAtNtLhXxteAHHQIYiu9c3qy8RbmL4nNy1jRN:jerj7qtNBVu85Yiuia5ALVN
- TLSH
  T108D29D52AE905C55D42BCA75E4E24D2AE636F1500F90D3EB2329824D1FF27C03DBE6B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  app/qml/QtQuick/Controls/Basic/qtquickcontrols2basicstyleplugin.dll
- Size 30KB
- SHA256 5cb2d8743c032fa5107af7021f7963cd6a7cb10b544219ae2c6fd112fa372daa
- MD5 87690acf59c121f8b6f8f6fada552052
- SHA1 d4e3df6fe51795edf9a7d414b0a4de61ee49fcd8
- SHA512 b8ed2a2569f771b7a5aada354e4ac0da928c87eb24e67945c6f734da89ceade03d093f4d91bb501ff8e1b803082be77fef3d7b2095d098183525cb0a1ef31e1c
- SSDEEP 384:j3dRFhoXL9TOC1RTDLhxtwUAhSHQIYiu9ceO8y8RbmL4nNyMBEziw:rOLtrTPftrt5YiuiT85ALWezL
- TLSH
  T127E28D429A944C81D837CD74E8E38E2AF532F2551B91C3CB7269419D1FB13C13EBE6A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  app/qml/QtQuick/Controls/FluentWinUI3/ToolButton.qml
- Size 3KB
- SHA256 0df93a8799842d8760b2abc19bf9b4e98c51259745b74236229c097ad0e4d001
- MD5 43935a3d451192ebddcf03fc0cf97cad
- SHA1 9bfb985f0db45f115386982b9dd818d7a6dfc053
- SHA512 52b8a08be9b02e5261952702468c23e548334bfa54ef6ba824836e13152710afc836929bdb66e9c4e90cdd7c2128edc5a43ffe7bb5281bee7205ae7b48783d4d
- TLSH
  T1F3810CCAC67A5370133A8A9DAB47C848FB25D647E552581B341C79E83FF6080D3E3A69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  app/qml/QtQuick/Controls/FluentWinUI3/impl/qtquickcontrols2fluentwinui3styleimplplugin.dll
- Size 29KB
- SHA256 231b54c1ea20ea0eff4ad152417ce65f7b5ddc08bef784f574f0a75c6fb3a00d
- MD5 450e06c62f93f2163a4123172ff706c3
- SHA1 c3dab92dce13107cc3a58fa1cbc067a8b65b7482
- SHA512 bc9a8a0d7fe616e00cc85838b1d8d622001ae0c9a61188a569f33a7b7acc74a708d38c55ac3eb5cfd3d20aa0c7687aeb167c71ca4727a07c64ff36bdc3ffe482
- SSDEEP 384:H+lSXvjrOHvHZQLhfwSjIM8HQIYiu9cNRc9tay8RbmL4nNy9Y4:T7rOH/ZIdwSjIMG5YiuiNH5ALI4
- TLSH
  T156D29E52A9A05C55E42BCA34E8D28D3AEA36F5550F90D3DB2365821D1FF13C03DBE3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  app/qml/QtQuick/Controls/Fusion/TreeViewDelegate.qml
- Size 3KB
- SHA256 47c5590cdd17b04dd3c75bae1738e9937a2182c7758a9b5a4aa80f4ffffe09e4
- MD5 0e7478c8135b531f982886851a2e1c13
- SHA1 3207e68ccf822300213f0db294813d06033128b3
- SHA512 33c78d9d3586103e8401933f3b359f6d7afeb1e4b7ff0ac2e633c340b87fd117d0aebfaba5a524fe09c6d7ee75f3f3b6309a67bade21a10eef4a1ebfd048f268
- TLSH
  T172810021A2712331913AC62A7B96E549EB13F427D79210123A6C699C0FF04D2D3EF79F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  app/qml/QtQuick/Controls/Fusion/impl/qtquickcontrols2fusionstyleimplplugin.dll
- Size 29KB
- SHA256 eaaef2900065225a3798b6694cdbf397e6b5ac84f297aa07e6a5110f2ef2bb3e
- MD5 ec10a71fd672b112fb5cab13b49b9613
- SHA1 fc8952c0b9e90eb6e78bb8b992899db20b8f024f
- SHA512 d4b37bfa936615e866274593fc78390cfc2bd69ab4e8989ee99d414fc495877cac5e2ab7f55d41519d4bee0166aa8c17e343b7b77230a66da845934f13fb0e45
- SSDEEP 384:P+scDrxLl453Lh1xtRjHQIYiu9cety8RbmL4nNyIRH:verxm57fhT5YiuiU5ALmH
- TLSH
  T1F0D29E53A9944815E43BCA74E4E68D36A636F2611F80E3D72369821D2FB17C03E7E378
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  app/qml/QtQuick/Controls/Fusion/qtquickcontrols2fusionstyleplugin.dll
- Size 30KB
- SHA256 443a9df5035a7a4f90925d9924f40e6584128e25e4b98a9e6800ef796a722969
- MD5 9e4e80986e95f64f0a93808c34c83462
- SHA1 b09512b4db7f68d2f7031050f3af103544138950
- SHA512 b0f3fb437941160e6dd6327501d8b6a685e23c3cfa20bacfb93b4be15911ea4988607ede972da6931cf5136525a6d1fcd73750a66967a5d1666988b89ecf1e43
- SSDEEP 384:iWi2FKFhoXL9iI6yHLhLtwRzHQIYiu9c7exy8RbmL4nNyZe9:ibOLqyrVtyD5Yiuis5ALW
- TLSH
  T129E28D4296944C45D837CD74E8D78D2AEA32F2942B91C7CB3365418D1F717C13EBE2A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  app/qml/QtQuick/Controls/Imagine/impl/qtquickcontrols2imaginestyleimplplugin.dll
- Size 29KB
- SHA256 2ee0a941a3a02968c5bbcc0ec03c5c3bdc5da3eb42c14be2fadafb9a1a6517bf
- MD5 a4a138d11a829bb8b279059f6da7a180
- SHA1 6e8328d845b791cd32b2726625c41c9e8bdff846
- SHA512 00e459381892c4b03606ea62732d166b289067b09e3c3098a2124e1c31c12fec0a6fb8de585b06f037a7ba12cc42a713bc518f3e0534a111e4f0bd15f6371b8f
- SSDEEP 384:k+GcDrRsNJAdrLhpxtwYHQIYiu9cLgcSky8RbmL4nNyWH07g:QerRfdHzgS5YiuiUg5ALWV
- TLSH
  T161D28D53A9A04859D42BCA71E8E25D35A636F5510F80D3D72365825D1FB23C13DBE3BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  app/qml/QtQuick/Controls/Imagine/qtquickcontrols2imaginestyleplugin.dll
- Size 30KB
- SHA256 0c5e87b82bd74866632b443683f3a897c042802ba7c72e5b4eba619b87c21197
- MD5 d8bd614aad252c69253f53858cca9cde
- SHA1 7cc08b4601723b761ab60805e4750b74ab9b005f
- SHA512 fee4d598a1bcbc5b689f0db7d4b35122005bc5720d934b4c7b3cff9ea4720976c04fde30b067f926fba9f6b7c389fb5c3166b99fc0164568ad1f1890fc038b56
- SSDEEP 384:e129fFhoXL9pf6Q7LhbtwcV2HQIYiu9cWCYy8RbmL4nNy1U:7OLOQ3FtnM5YiuivY5ALQ
- TLSH
  T13BE27D4296941C46D923CD74DCA78E2AEA32F2551B91C7CB7365818D1FB13C13EBE2E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  app/qml/QtQuick/Controls/Material/impl/RectangularGlow.qml
- Size 6KB
- SHA256 96645eb91f5475886ad5c36f5effc6155586fa8f0862a4c0d201426bde1ae7a5
- MD5 f3d0bea71b882d42f868e167c3e9468d
- SHA1 7f0af36d47eee3796c786025228e2c1811652acf
- SHA512 ff0562a8abe16294bc95695dfac3ac2ed6d61dd5bcd49b0f43e3b80d7ebcb5a1d56a8fc84c9cc0f4b7b19cc64d0dfde1673b7ca76427d464e39e306e34f923ed
- SSDEEP 48:YxxxBsio5JAS44kH1KWRmoAAJ/H0SAAd449lM688YAAd44dpYG7ECyNfRjEzVTml:YZcJA/RmEZRMTmtnWwbQ9VA
- TLSH
  T154D167307B8F02224376857C0DB85DC8FB9E61C7A2215B4477CC82BE8F7805D9AD5AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  app/qml/QtQuick/Controls/Material/impl/qtquickcontrols2materialstyleimplplugin.dll
- Size 29KB
- SHA256 ca320b3e07d3bc547379b4a40a4384c424b63f3fa89412b47a6285fbd251fd7c
- MD5 203abc6f1cc7cee96bc7840d0ce08555
- SHA1 3c3257c06e5ce05b4c14aed2a1a3cb2a3a2738b0
- SHA512 e0737826c75bb3b5a7e581ffc5ebd3cb524fd86368ee02edb5d7fcd8c0a719fbc2defc9e656fffbf4bbe6c1f0f304d34a4cb5ea91eab9777e9bbdfd1ef914db6
- SSDEEP 384:k+gcDrggX8AmXLhGxt+KbHQIYiu9c81y8RbmL4nNyqS7:2ergQmb8uKL5YiuiI5ALp7
- TLSH
  T13FD2AE53A9A45826D43BC934E8D29D3AA635F1514F41E3D72325425E2FF23C13EBE278
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  app/qml/QtQuick/Controls/Material/qtquickcontrols2materialstyleplugin.dll
- Size 30KB
- SHA256 e302717cf8c0c08482b8215b0735b4d905715f78024c16f52fd0c78110cebcb5
- MD5 28070d91657cb3c39d25abc0fb16b5c2
- SHA1 25b9f772a86ee84b17b0f00a6a8e946fd163dd25
- SHA512 27d478ee5e3d626e2f83745f8265f1b7cf2bc1d085a67d750bd9a96b06a1a9a0d860fd14a25a640586be147260209316dd4b3c5a35a2412700d2eb4a0fc41cd8
- SSDEEP 768:uBZ0ak2yA1Ph2pmopM5YiuioUQHU5ALCkt:uPM2yAf2pXp27u5Urkt
- TLSH
  T100E28D4395944886D823DD74E8D38D1AE672F14A4B92D3CB6364819D1FB23C13EFE3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  app/qml/QtQuick/Controls/Universal/impl/qtquickcontrols2universalstyleimplplugin.dll
- Size 29KB
- SHA256 685f0649bc3df6f68b1a3574b1c1d421ae42fb19fe1d3b29b37a8eff1dc4cc51
- MD5 c5960ead8c5b3898bd752ed272ce81f9
- SHA1 3e94e54673ba9020acf2984964984650d574da05
- SHA512 815a61595641a5c8dd553d99d89ed57fefd62d48f93df9cdf3f59a2386dcfbb678303acacab9f5cb7035f74f46dd4f8398053fe81bbe2b4e6fb1b1e2993f28a3
- SSDEEP 384:5+fSXvjrkQgLhQSjWoHQIYiu9cJSy8RbmL4nNyqS5x:T7rD4KSjWC5Yiuic5AL1x
- TLSH
  T179D29D5379A49C55C42BC574E8D29D2AA636F2520F90D3EB2325825D1FF17C03EBE2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  app/qml/QtQuick/Controls/Universal/qtquickcontrols2universalstyleplugin.dll
- Size 30KB
- SHA256 caf2d3c96e7930b46d75b03bfd807cffa71890221e4f7461e40609366b85d057
- MD5 5c87b9f4f84d1e3108303e3a53e9779d
- SHA1 e6cdf2400342d0611dd9ee1f84c8b17f43621d36
- SHA512 cc4bd1cb582e6fef8c8f46dd43090ad23f3c3f807ef51df75b5636a85e7232001bc68395f11fff56e4b22888f337d452661a9ce477f9a80ef3b33367d5330659
- SSDEEP 384:uPYueD66PhoH2yNpXl6LhdpUZeOHQIYiu9c8u9ty8RbmL4nNyOkmY:uP066Zu2yXXlaTpmek5YiuiNt5ALj
- TLSH
  T11DE27D53A6944C96D423DD34E8939E2AE636F25A0B91C3CB7264819D1F713C13EFD2AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  app/qml/QtQuick/Controls/Windows/impl/qtquickcontrols2windowsstyleimplplugin.dll
- Size 29KB
- SHA256 e58576e88211ed98f1d129885f4440ff0cca4de3d75d7e6a5a8ff6060687a692
- MD5 6e90edbc067767b9bc4a9bb312605e10
- SHA1 cf2efa394befc8f4f3f6eb3647768028ad9067dd
- SHA512 32da0bda3bb21363ade9a8a1eed9ba5e67c7313c62796a06716ed2c382a186416dcc54e6148c956b85fe892ee9f60cfe9058f7f4bf07f2b7a640a2db45611bf3
- SSDEEP 384:p+GcDrODJiA2nLhAxtIZHQIYiu9cBcovy8RbmL4nNyGA:3erOT2LG495YiuiOov5ALL
- TLSH
  T12BD28D63A9A04815D43BC630E4D68D36A636F6610F50E3D72365815D2FB27C13EBE2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  app/qml/QtQuick/Controls/Windows/qtquickcontrols2windowsstyleplugin.dll
- Size 635KB
- SHA256 4620d3e8a8734b542c35a77acefdd17e70ec6fcf536e9f198ba825cdb7029353
- MD5 fbfdcaa1e6686ba4ddde69c3f6fb49c3
- SHA1 3ca6535f32caed15f80766f574c9d000c47cc5b3
- SHA512 1f226c513ff54bdab7279b34cd5b54c6b6019c9b899f22d4a07a6db99151ba5dee8df9299f390612236cf1f6dcb91dc085e82ec5df3b2f16767d4f2ee6a7ad44
- SSDEEP 3072:GUpSaE/Hwi3bZDv5PeG1vmVJpktvMPyu0APoP9ttImPhGzDk0qMYIOZEf+X1OTvv:mwiLtBW/+SauIAF1YeaXhzB5aAaB
- TLSH
  T137D4E82773B48349E265C174C997C622D3B3B4242BD0879F3229A65C1F777831E7A36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  app/qml/QtQuick/Controls/impl/qtquickcontrols2implplugin.dll
- Size 29KB
- SHA256 beda7f84911d3474aac02e16f2c1558639777a123255beaea530a35db66742de
- MD5 56057716724a6c3fb4f4078ea557a44b
- SHA1 9a35b3834ca54169ce20c736a27c0e34c8e104da
- SHA512 0e619170c397e4051ba2a1561874f45e0f7ca7139391cf3b997ab3496f88422bcc4e0c54b742818d2d9c5f8d7c554d9107c6375c0cc9d197bf53f13223ac0040
- SSDEEP 384:2+jHh7vbFZH4LhmsqHQIYiu9cp9y8RbmL4nNyoFL+:PHhbFRAssA5YiuiL5ALUS
- TLSH
  T19CD2AE57A9949819E42BC671E4D68E26F635F6604F90C3DB2319425D1FF23C03EBE2B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  app/qml/QtQuick/Dialogs/quickimpl/qml/+Imagine/ColorDialog.qml
- Size 9KB
- SHA256 bac39b2fff8da575c74b7845f0d5a205dad41e03e4ad75c1559b991981ca3a23
- MD5 b2fea55670a50452b0a1c7e2f2ad019f
- SHA1 d79a3bccc15c81eba3881fb81c63e7075517fc70
- SHA512 6e7ad6afa7919a669cf8b5cbd7d84c36963f891b07f2341b06bdda7df6bcc03166e8d37bc6a12606047c23f8f95bfb8e241036bc5ec3ed7c384c0a3e616f895e
- SSDEEP 192:qVgobR4T6EwS7bhO1VCeU9r+Pe7LDXRCkk9q:qb1VCXRYI
- TLSH
  T180124149E5642132E233DB75EDB1DA5CF763A323A100C8AE7A9D47805F7868192D3F4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  app/qml/QtQuick/Dialogs/quickimpl/qml/+Imagine/FileDialog.qml
- Size 7KB
- SHA256 90455873d4f0d031e70d459aa8016375e3d2148878e7bb22c954349d3e2fbcd5
- MD5 ee2a8eb00d4faba9895ff14a0da6853f
- SHA1 2d3235a782aa9c3dd9511125e0d0aef5f903314c
- SHA512 ab1943919074ef42731d5bf1c34852c2dafcacc04c73baf7d681be3871b8c0f6cd6618d44bb92830d1c4ca3cfd40f5c56650159add468d73751c34249f70cc2b
- SSDEEP 192:ztPuLbR4T6EwS7bvxUq3v7Ph29PmcBLqG5:ztM5spsPXl
- TLSH
  T1DCF1955955781174E6BB9B32FEB2619CFB239163A101C81E3D9CA2811FB864CD2C3B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21
- Target
  app/qml/QtQuick/Dialogs/quickimpl/qml/+Material/ColorDialog.qml
- Size 8KB
- SHA256 2ff66de69bd0617e5f1d1ee6aef4410ab5ee71d9acef22c6b951227555b76bf8
- MD5 03960537e866d76aeac4ec356ce522f2
- SHA1 353aacec1322c5e114257d5c6dabb95a86421e1f
- SHA512 5def9824d512c61e2863d0b2de99d77297b811ae4c11334f481f05d58e659f769c7bde89a349e510d95956fe0997c1adef15028f17775450d5a6e5f967d9a072
- SSDEEP 96:q4+rG3vk3L/pZrJMFRifvNvKeUmFyjr+3/LqOmyC13fy8eXjCGB2uM8N811GYc9z:q4+rvbRtfVCeU9r+PRmY7XRCkyLc
- TLSH
  T14C025484912421329533EB75DDF2DA5CF763A323B50188AA7A9D47844FB8641E2C2F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  app/qml/QtQuick/Dialogs/quickimpl/qml/+Material/FileDialog.qml
- Size 6KB
- SHA256 cb53fe576edfc79ffb3891c1b22a810c563761f89001a05913b3a34bb785221a
- MD5 745f8ce86a1f4efe368294cb0336c41b
- SHA1 f6d35e4a4f712e986a193f770f88c730363cb78f
- SHA512 9062d225e0405d0090d7376b4749ab8c539e8f60c7a99756e3b0d24facab9e972219e75944d688116f22841ba4acfdca1af675960cdef4485f69200e7f8b118d
- SSDEEP 96:ztm+rV3vk3L/pUW4x0X9zQ3nW5FmiwuGjUlmO6sPzycf2Fcqjl3/3DQacG4cN:ztm+rubRQx0i3WhnGg3PmceLh/Uakg
- TLSH
  T1CAD1538851292560C5BBDB36FEF3619DFB536157A102881A3ECD53811FB854CE3C279E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23
- Target
  app/qml/QtQuick/Dialogs/quickimpl/qml/+Universal/ColorDialog.qml
- Size 8KB
- SHA256 cdc5b2822f28b129b40cfbad73f9857a38dba985eba248e396736f520c407e76
- MD5 f4290fa285f3ab8d89b78f46dceba465
- SHA1 695eb0eddd5a825c93b6480b19508a9fda814ece
- SHA512 8ecda0c220f05d1dd99a37a848a0d6973deb16858c2edcc16b519e01fcb80a0df5b707f0acaaa04ee186e3712cbcc2c8e55c7f8e56405808b7942dac379a4e46
- SSDEEP 96:qNG3vr3L/ppr9/TNWGvgv+eUmFhjr+3/LqOmyC13fy8eXjCGB2uM8N8PNGpc9Ms:qN0bRIGoGeUCr+PRmY7XRCkUuY
- TLSH
  T14E023345E12421239533EB75DDF1EA5CF723A313A60184AA7F9E47804F78541A2D6F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  app/qml/QtQuick/Dialogs/quickimpl/qml/+Universal/FileDialog.qml
- Size 6KB
- SHA256 437122ff307af58f815c7dbbab869e329014c6c1bddea5eae863d51651a5bc41
- MD5 d05ce7e188961161e792c344e211b1e5
- SHA1 5ff2469d350e31459abca3f8d0b565f0dc74257e
- SHA512 788d014389ce10aaacf0a62b33d51ac69a42efc9b15cc76f3de5e146ce38a73c108568642b838cfa5fe417fbf25fdd404d2b860627be6c91babc3984755cb382
- SSDEEP 96:zttV3vr3L/psW4xv4zQ3n1o857vv1jUlmO6sPzycY2Fcqj6UM/a9v:ztt9bRoxH3R7lg3PmcBLnii
- TLSH
  T15FD12149523925A1D5BBDF36FDE2615CF7137157A201841A3E8D93801FB414CE7C278E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25
- Target
  app/qml/QtQuick/NativeStyle/qtquickcontrols2nativestyleplugin.dll
- Size 907KB
- SHA256 4d28ab27b9c2b09431e2401e991ee950760403c3905bae696c5e29ef723f84d7
- MD5 ea76468b0ea949059239b60fc9fb2127
- SHA1 32cff5d087cbfa16a9544e6b52dfbe6cd31f6892
- SHA512 4e6466aee22983c3e3a7611bacf862afe0ecf33387981fb1734fe51ae3ccbea402ecb7e9a092c07313bbb8a337a2a1d0e58383cc261ca8b35e14ef6a8e71af8c
- SSDEEP 12288:k25upJdSXSy0NIx4dn4VmFLhyrS9SDqHVeAp2gFaQMEltKl5goYAS:k25upjSR004dKmFvLxpCS
- TLSH
  T1A8155B1A73F94285D17AC178C9A78502D7B2B85067C097DF7228EA6C3F773D21D3A229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  app/qml/QtQuick/Templates/qtquicktemplates2plugin.dll
- Size 30KB
- SHA256 ac2f4ebb67aa49fb2d68a4db1d82e530823a71232dad450570814968e675ce78
- MD5 a96b524eef24c54e527356b93974066a
- SHA1 2fb8a4ac9d7c84029930ed2469451d74b827769d
- SHA512 d9a85a49d900a3d1f66a6afc749dd919c2b28e27feaa2281846d5ff0aaabecfec1c330123a28963d1649557526e5873bf902304fb93faff5847f5e316e0e9cf5
- SSDEEP 384:FkciKPbn7tZ175Lh6fry3HQIYiu9cobqy8RbmL4nNyzog:D7tnlEzy35YiuiCq5AL3
- TLSH
  T1D4D28D17EA949845E937CA70D8C28E29EA32F1A01F51D7C76355828D1FB17C03EBD6A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  app/qml/QtQuick/qtquick2plugin.dll
- Size 29KB
- SHA256 0e3142f7df8ab4bc9db764e1a1d7653c1d03c7e5aa93055b4ed5d3fe6f74fa11
- MD5 2c7f7b6a74e5e8a30cbffebb51bf5c93
- SHA1 850d08ef5c9b38c4ae1ec8f43023bb1323d0bdce
- SHA512 c849a27c560fd8b7ee6e6919f76378277459f02448f9d7deaca0d43c17f80096705594de7f6472cf7ad2eefb2736aabcfdc30f89a9cad1544e8225c71e3c846e
- SSDEEP 384:pdKva4MsWlhqLhiHRK8JHQIYiu9cC2Ky8RbmL4nNyxqA:yMHqYZN5YiuiDK5ALb
- TLSH
  T10FD29D4369C88819E437CA71D4D28E2AE676F6610F90D3C72329415D2FF27C03EBD6A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  app/qmltooling/qmldbg_debugger.dll
- Size 208KB
- SHA256 2532ca498edde82e9f7026ac70d6429a705e6220e0bfcf6daba51ca65bb4f78b
- MD5 b6fe5d92fcf7f170c333bd1d6faf4b9b
- SHA1 f8930f399b1f16ffbfeeaf6c473e12c4c211c252
- SHA512 0b728d81dc519d2d09242e7ff8290c7e61de031e85d9941cdb1467bf5eb2f14b84512ad50e7705be19a26381ba760276517fb37ad7d1e64463884da476e0712b
- SSDEEP 3072:wUiCuB6qDpg9VVjLuy6gSQpCBAEmZcWQI6Biz7+Kcb56i:wUvuB6rVoykm0jmPueBcL
- TLSH
  T1B4242A2372941286D46EC179CA6B4A06F7B370414331EBEF4261CA792FA7BE1BD78354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  app/qmltooling/qmldbg_inspector.dll
- Size 98KB
- SHA256 6789c69928ecaf78e996f591c7e48aeacbfe3807a6a782c2e8f10cede3c27253
- MD5 6f787f310a09aa7ac701f442e2903dac
- SHA1 85475353e03da5f8c13fe1b9126c5eec09ba1c90
- SHA512 53c8cfa04e3cf9474469879c97bdc0bf96785a71dd465fdcc0a696d37caed424ddf54340b32950770835f513d1410200312aefe00f46e73a7365809e05fc4dc9
- SSDEEP 1536:4RX7i3cxsh8wNwU3CVNpOUkwPIgyklFsvPIgyTnMrKinLGA6gPGs7uw:4RXmKm8waU3CVT6IytyTn0KinL5Osz
- TLSH
  T1D0A35B1766990189D82EC23CCA834E15E772F0811B52EBDF01B5855E2FB37D12EBC6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  app/qmltooling/qmldbg_local.dll
- Size 38KB
- SHA256 6015f2d363a129f46eee0d93b1ce2c3023295b13630997abc75887a921d93bc5
- MD5 61bd5faa2e5ba5a3691bb679b039ac6e
- SHA1 6eaea5d58063ee8f1ce5c14baaa5add49bbe4ab8
- SHA512 9036a0abb5d151b89d80252a63ca33adea3396418a1a57dd07adfe04eaed67dd3ceec7576d712501ab40b3039645b323be1cdab7fabf8a5efd554288660a63af
- SSDEEP 768:Vwn49760PGQlRLlndkS4tgB/h5YiuiZ5ALM:cm7pPGC9XctU/P7uI
- TLSH
  T17A036B02EE55A845F92B8A34D4834E29F172F6508B22D3CB6351826E0F727C57FBE1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  app/qmltooling/qmldbg_messages.dll
- Size 34KB
- SHA256 b09d01036edffab6f7f5c6f5110e906a9f46c814a0f45554133b5ade7e0d2cc4
- MD5 c0d8d7068c070413d2957db7e8cb6356
- SHA1 aebc79e8434d02e40ed258b221c27bce1eddf888
- SHA512 1e87ddde81b2cd760409482623753b039ee4bcccfd3176765420e09f30e6671244397e0466e59774c55ef7ea68a288977214cc6e05762fd3fddbdb328d5ef58d
- SSDEEP 768:zc83q1FNVZ0ldOR9Sv14V35YiuiIW35ALg:oEq1FNW1Gp7uu/
- TLSH
  T121F27C1696650C5AE4278774DC8B9E1BE172F2410B52F3CF5395866C0FA3BC13EBD298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32