0a52d703a294c20b991e7eb0c4f58e7f8ef2503288e983f246e95a743559f5ca

Sharing

Copy URL Twitter E-mail

General

Target
win-x32-64.exe
Size 91.5MB
Sample260901-3bd9vayhph
SHA256 0a52d703a294c20b991e7eb0c4f58e7f8ef2503288e983f246e95a743559f5ca
MD5 5c8c9a8bb147ff87e7f93de548bcf0d0
SHA1 af319c82771b69c504dde46072671649d8208f4d
SHA512 1c34f27ba2d22069c2f4751e23395152eb4576a4398ba4a9b55c61a882c951edb293c547a9866092688eeb9c67b0b4070d6847816859946fde3adcd21385f31c
SSDEEP 1572864:KLdk+VN5RyX6XYg73kf8tUK+BJtzhq1KIIAQbXv39x7O/GsmB+QikKSkjRNkRT/k:K2cyXJnBJtEopAQzvbKYB+QikKTjRNEI
TLSH
T1E42833F08103AA28DB129D3277785D0BFC3431E82567DDBE6DD9D0A9B08A961EDF0C59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  win-x32-64.exe
- Size 91.5MB
- SHA256 0a52d703a294c20b991e7eb0c4f58e7f8ef2503288e983f246e95a743559f5ca
- MD5 5c8c9a8bb147ff87e7f93de548bcf0d0
- SHA1 af319c82771b69c504dde46072671649d8208f4d
- SHA512 1c34f27ba2d22069c2f4751e23395152eb4576a4398ba4a9b55c61a882c951edb293c547a9866092688eeb9c67b0b4070d6847816859946fde3adcd21385f31c
- SSDEEP 1572864:KLdk+VN5RyX6XYg73kf8tUK+BJtzhq1KIIAQbXv39x7O/GsmB+QikKSkjRNkRT/k:K2cyXJnBJtEopAQzvbKYB+QikKTjRNEI
- TLSH
  T1E42833F08103AA28DB129D3277785D0BFC3431E82567DDBE6DD9D0A9B08A961EDF0C59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 91.1MB
- SHA256 95dea95c9af3c9c7f65d4375f73e2e7855a04f2fdb849d7a07ef32b467e756bf
- MD5 9f3800b0e14cff473b1a117564f1eed3
- SHA1 73c60d232d4dd3c7416e0e68a6755e6511d0500c
- SHA512 a04ff2efc9beb04fb7dc097614b81f15ae214dfcafc9383bb145f2853c8562e47fa834045eeca50d33529695e30d62ce13e6dd203db0a39cf3b0e99071a6a30e
- SSDEEP 1572864:1Ldk+VN5RyX6XYg73kf8tUK+BJtzhq1KIIAQbXv39x7O/GsmB+QikKSkjRNkRT/P:12cyXJnBJtEopAQzvbKYB+QikKTjRNEb
- TLSH
  T1D22833F08103AA289B165D3277785D0BFD2031E825A7DDFE6DD9E0A9E04E961ECF0C59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
- MD5 b1bccf31fa5710207026d373edd96161
- SHA1 ae7bb0c083aea838df1d78d61b54fb76c9a1182e
- SHA512 134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91
- SSDEEP 3072:AzwJCGIekwENgMBsFAXg6VKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Azw1IekmMBdQXK18Gb0OV8ld0GecQ3Ey
- TLSH
  T174E3E1D7B7F4ED3DCA5B56B7A61500B2ECB346780691434B078AD8363A76748D8C8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  chrome_200_percent.pak
- Size 229KB
- SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
- MD5 e02160c24b8077b36ff06dc05a9df057
- SHA1 fc722e071ce9caf52ad9a463c90fc2319aa6c790
- SHA512 1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e
- SSDEEP 6144:gDQYaSN6svydrI8jDQUgx5GMRejnbdZnVE6YoppO4:NfSN6svydZ6edhVELoXO4
- TLSH
  T1A734F1D763F89D3DC9674AB3522601F1ECB2013946B6424B03DBED357A96BC988C92C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
- MD5 74bded81ce10a426df54da39cfa132ff
- SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
- SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
- SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
- TLSH
  T19AB63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  locales/af.pak
- Size 478KB
- SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
- MD5 2602cd68ebe25f12f5d9892d5fa92b11
- SHA1 478766dcc8ce4427872bebd81ad929f7aef250a3
- SHA512 6bbecbeaa6e09857a5698a280475496498a88488249025b2f58ca7a8493a77bc13fcd783041a6198f58696f4e2a84c3dbee0891e89800dac6f3fb317f70c5492
- SSDEEP 12288:3an0y+3zo5ExirXKhaG1B2+H2JynyaI4IVzZo0vgElgA2W0PSq+2ss30fzO75g6D:3a0y+3zouxkXyd1B2+H2JynyaI4IVzZW
- TLSH
  T1CFA43C06EB84273D09A07696BA0845F7FF9CA26CD770B2B6DD9D823509A6EFC017D0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  locales/am.pak
- Size 776KB
- SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
- MD5 ac7a72616a544cdb022eda20b0dc8872
- SHA1 50b7f8363894a7e33042412804efa2bda510aba2
- SHA512 d5b3b851a0d6615eccc1223cfba6b285ac8387e0c0f9df1fb5bd95c9a208813b31f56546fc9c624e7f3a12b35ab7e8acd13ea85025b5f9cf74def60ad679a546
- SSDEEP 24576:/x1ATZg8/xp1GCj+VRRz085d9tcV03OzPkS:Z1J5Q
- TLSH
  T181F499547EF9F7570F8E8A19A4320E4EA594AD4652803C38C35AE3FC2B2DF1B4DDA215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/ar.pak
- Size 851KB
- SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
- MD5 4d0a0771176823bf004f9182b94bde82
- SHA1 7e0601d8dca0404736787d85918d1a680a7e68ec
- SHA512 6dd144273252026bcf08be52189ea5a15410a42a616c9fac14edb4be7d98023b65fa1746ed50b654e57f140790e8a92b1080f2f035adb81b7d10aa473f2dca61
- SSDEEP 12288:4P9FlB5/G/d/RXCwR14fvPUKzUUk/K5MN0j+OzIh4pG:4LhQza5R+9
- TLSH
  T19A058BE21B2984720B96DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E674
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/bg.pak
- Size 885KB
- SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
- MD5 d0b47c1cf62b29b866ca630958a019fb
- SHA1 bae6e1af9d7225584510443aed21a40fcea349e3
- SHA512 39472b1f6859c10cc782a303761d63a2409807d7d342c3bc558075284cf455a26c3e1b9b4ce67a5fbd84e6c4b621adcfd8fd8a819cfc25554962454e5f4b5816
- SSDEEP 24576:E+CDcquMMLYzzQkECPUwVbtcHU373ZA+3aAKHkVDYyKzumpod2nm5c0XuGox3QN3:hCDcquMMLYUKUwVbtcHU373Z93arkVDn
- TLSH
  T1C11514A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/bn.pak
- Size 1.1MB
- SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
- MD5 83a0030387afbe1cd2d6790079fc5024
- SHA1 9d4253d253167aee6f3ba9cf6f8f376266832d00
- SHA512 20c92c5c3634a9663d933aa98d9356e18beb8927f2975778967a65cc25522560784eabecfe99037008689cf3b77093c35d3f109f32ae2db2160e9798415a3771
- SSDEEP 3072:iOXg1lMf3u3jGVxXD7unXU7AI2HSzhb0Ylf14/QISydDbsh8VBbFKQg5hNDl2Ob:Hw3MvpXD7unLxSydHsh8VBbG5Hld
- TLSH
  T11445DE209C6E91B2A8C5CDC9434C6370C5236E9B9B65F74DDC17A24938ADC3C8CADDB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/ca.pak
- Size 538KB
- SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
- MD5 d5d6200b582b9b12a0bd8c773dea0474
- SHA1 341650b76af1c74129a97725673b646b7256d4d6
- SHA512 1465e7214c4ae818b545778b831b7773f0373726f705160ba4df33ce3c206a2166c8b6519336fd2b1e405ef6811d2cfdc2a655f1b767bf9b4e083c6a33b34ae4
- SSDEEP 12288:WM4Hy2Q57BREeApk73K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuT:+itVzaBRn1WDMN8UpOO5J/ras
- TLSH
  T113C4E9239FCD3B6744D2320AFB46C217F48CA9847B06D254E4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/cs.pak
- Size 555KB
- SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
- MD5 0e52ac897f093b6b48b5063c816f6ca1
- SHA1 4f4febb42fd7cdd0bc7df97c37db0e4aa16518e4
- SHA512 9cf5594ac47ae967bd4221f61b92c97343ea0c911fbe992d35a9391e3e1e6560b1b41bd031074cd262a622ca88af3b25ba33575b456a4d5b8a7b897233c0a54d
- SSDEEP 6144:0/AkCOZjqspN1oAUGCDAfiebO5zU8rEsiNOPY3SBFmPy38Qu:0dJZuSPoAUTbe65zU8rEsiNOA3SzmPH
- TLSH
  T1FEC4492EEEA36425488002497BBE4128BD1E83540B2FB5BB6C8F9D91217577ECFF4D58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/da.pak
- Size 501KB
- SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
- MD5 d5bf4aba2d82744981ebf92ccaadf9c0
- SHA1 1a1c4ea1d4ecf5346ee2434b8eb79d0bf7b41d46
- SHA512 5bccc18687fcefad5e78c5c8072acea36ce7687c5b848a1e0367c82a38f32f46402ff01edd4fb1379ee77083ef0e1964e24bad87b18ce78077b28f0c1bd4bd08
- SSDEEP 6144:gRsuNwWzVPsP5sbse814e8jKwlRDdJwL2obEZZaFRQ5Mk2rkvb3d4nTGqFwJ:g6qskjdTv5M/rvTpu
- TLSH
  T163B44A4BDC9C732F89AD4A65F3108DA7EB5D943CC684264F65D894390ACFC6093BE2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32