260da5ddb2db864d2783bcaad478017f44ab63a702e265863c9814148c2c3bf4

Sharing

Copy URL Twitter E-mail

General

Target
SJTweaks Premium 1.0.0 (1).zip
Size 87.7MB
Sample260905-3dvplsvbma
SHA256 260da5ddb2db864d2783bcaad478017f44ab63a702e265863c9814148c2c3bf4
MD5 b838b1ca5f66cfcf4688d425c5642b68
SHA1 99281d2da83cf1d5b9900327a4c184726c41cccf
SHA512 5af29eda6db1a7e95c2f930762ca77b97254bb788236b26df6f08f3d01e36622019c1752c90e3e2c4628b5844da5af6d800ebe79d53bedced4cd80197baa8d27
SSDEEP 1572864:hYxcMA+f/2VOFKT4fptVXyqE3EFgyekfoERmWyBIOnYfKkld1uO1L2CpzN/skG:yo+nYmKkptVXy7pbBr4ld1RLz/XG
TLSH
T1A81833D320A4CF8FC1825E7ADB92BD514E6D2A7363C7D94409D3F4E22AD8BA74B59103
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SJTweaks Premium 1.0.0.exe
- Size 87.7MB
- SHA256 99740c8535d4a12a07171d8da3fab5d74cf909cc1baabe04ed4095a2897129f6
- MD5 fdba1ce1ab129831432da8bad5241474
- SHA1 f91bf198ea96742127783084dc5c350528103978
- SHA512 f741e872a06c548aced35c5f047e87df40e66726afdf80b12c777596a47636953a41af15ccfcd87cd0d3c7f59ec06cb0c56fffb45bdaf4084afc70591256116f
- SSDEEP 1572864:8YxcMA+f/2VOFKT4fptVXyqE3EFgyekfoERmWyBIOnYfKkld1uO1L2CpzN/sk7:fo+nYmKkptVXy7pbBr4ld1RLz/X7
- TLSH
  T1A61833D320A4CF8FC1825E7ADB92BD514E6D2A7363C7D94409D3F4E22AD8BA74B59103
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH
  T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  SJTweaks Premium.exe
- Size 201.1MB
- SHA256 237764875bc2442caa30d343e11f97c1c553a7356aad25f6ea9fc8f25a195297
- MD5 89db9f683409749912f9c5ff13c86b0c
- SHA1 2d5e2ebd7b35df6058349c8463567ba921e08225
- SHA512 3865e1d0e0b7ac8ba722abfa9b7fdff7d2c076380d085b6565990fca5391a8f35b622f5294faaa040b858c0d6da0835f490680c896cbaf08c59632e100fecbc3
- SSDEEP 1572864:whMtgUaQTwtGgBcarGuvmXekc+QbYK+vdEFT6/0qxf/9SFnucpLDCqMyvJZmD+Je:J65VTcDFnNt
- TLSH
  T191A87B03E29601E9E05DD1759B5A9633FEB1B8094724A3DF2B5407522F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution ransomware spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 6f02237496ce3d04459539c530521e6ae2aa05dc6e3f669769898e604b8d5dd7
- MD5 36ed84518cec417689c14a0a6b5bb45f
- SHA1 9815663b6d9c2d38b322f5e2c9f7c6ea80adaa52
- SHA512 27cc09be5b9975400add2d054647d430baa1c2e512322b45fb52d3e18b9951191aa77aea11eed66c031b698958477c3e7f48f0f8ba7b592d2bfe669909e0f62d
- SSDEEP 196608:Z+kiCf+BWW8fUA4BejnQI180uNJSf4iIJwEMWRsKqvU:Z+kNf+BWWyUA4Qjnw6+RsKqv
- TLSH
  T1BD4729122246D49CF059C878C3678626CA6C34E73FA779EBC0B461252B7BEBC5B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 e8ef0c488acde7242b318b7babf6e45297a57ec968abd700f989d6269bf36831
- MD5 beb482ccc819f4112eb44714bc278f6a
- SHA1 715f27372653097510a2a2a7b9d39faeadf5e67d
- SHA512 71c85a14d4135f606ae077c85f294d53140b33a078ec00415dd780a68fe607b81039e0a3b283502556d4cc148204dfe8bc378288978f73fc1d5f5ac50eca0077
- SSDEEP 49152:2ESTAZFzTxMIP29EeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGH:2DaTSEYht8OnZGNxcO6IhgiS9Nol7Wtu
- TLSH
  T1F1E5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libEGL.dll
- Size 492KB
- SHA256 cc90ee15962abb35fcc409b854de08b2e640b5aa44c9211be3eafca43917074b
- MD5 c929717c349759a1f94e25927ded50f0
- SHA1 5adf39da408d8295811c9e08ce9147e37b9099ad
- SHA512 79fe838e0fda944dbf299fc6f3b4b66a3ec2bb7e7640c607b012b04bbd7cb3fc8a526edfb4d403c0c96044f62e77d401517063d6a5c69197dbe03be925ab960c
- SSDEEP 6144:wtqwvC8uRreZw/ebZyu5sIAeoZPw1ODZ6R3/8cWqR/H2p5HoS/hg:qqwvC8SrZmNEIsPwa6R3/8cWqt0HoSa
- TLSH
  T1EDB49D15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 273e0c34c3511fa793eb8c7a30623218c530c01668640d890a70d8c77a5a9466
- MD5 bfc79aba42f0b047f07ab43e9b53370b
- SHA1 b14e2557f1c50a9e670f66b7e2eba55189b92d9e
- SHA512 4aa36093fb2bbcd7a88aa463d1381fea6e264f3d0e1071a1c8772c63827191a3b6c1788bfd513bf0f81539654afde0fa51ebe1448b9899425720afaa8ca3473b
- SSDEEP 49152:Qh+XpQjxg3kJXrCtf/EbJ2npdfPHn7VHe1yTveomnSfb+5LDrpRXJDysxrY0U5Aj:ALMXVv/f+vplJLdPCuAYT7tc3j38
- TLSH
  T149867C03F69581D8C05DE2B8975B9227FA31B8490734B6CF2AA413152F6BFE0A77E354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 1df00e64394fa563016ec1885271e4665d5813da5f9d1ce910d71d9a090e5d81
- MD5 19db0bc069aef9cc4c3abfc2cab5a5e0
- SHA1 401d28e50039c703c1e17786fd8a19322b1c3bff
- SHA512 dee7eb1bd2c63085692b6c63340a742d00587375f4b685ae13248082bb82531c6e06a0fca83afba08b20608e65418e6aa48d5c2599a0963961464bd5d6940839
- SSDEEP 49152:yVlVRGSYZZaeYaOIHsu8n1o/n8fZ/sZSR0qCWUT8HeLig4SYLMRfXSlx1CB/wU/7:mlDYZZaeYwqqblXQ+9vWy
- TLSH
  T1E0462713F28681E9F06DD679875AA623F231F8844B2276DF16A01F192E77FE06739710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  vulkan-1.dll
- Size 922KB
- SHA256 e6663e25b7380f110166e194eff87257bb25a2a7455037e9e0f33bebeabd1d6e
- MD5 76f5dd275f15865b1bc3942087b9ce43
- SHA1 78b5c19c4a7d8097af1210f6cfa6e7e6294d3ebc
- SHA512 538ffb725423e204ba338aff5e6cc9f81d7951ab47afdc56de806234decfb33e2e54f7a5d1daa667074d461f9f801848cade0db2aea629dcdaafe70ebb3d6ce6
- SSDEEP 24576:pGVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAF:pGlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQ6
- TLSH
  T13B156D23965485A9D47AD034D9D28707C9B174822326B9CF42A81708BF6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Hide Artifacts: Hidden Window

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

Hide Artifacts: Hidden Window

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21