8e15a6f861aaa8e93bb26d192f6f7cf7bca9a7538b734f1bccb5c4074ffaa1ed

Sharing

Copy URL Twitter E-mail

General

Target
Era Setup 1.0.120.exe
Size 146.0MB
Sample260905-lqa3asywcs
SHA256 8e15a6f861aaa8e93bb26d192f6f7cf7bca9a7538b734f1bccb5c4074ffaa1ed
MD5 66a8f152e073fd717df29bad36cb33b8
SHA1 18849fcdd6c9a04c8b88927fb2d664b8a3e2e83b
SHA512 8e55ba6109b26d7b84eac1452d2ad782c7d5bfc039eadcf13c72fec486b1bc715e1169498c25bf06594f573f33803e1bbea899a3af9f3472e5736f506d66764b
SSDEEP 3145728:Ntw+poKrRnDaumGWLWsyK9kEv/LKPXD0XAgdRnD5:nxpooD9CLWsyK9f/uXkHzD5
TLSH
T1D178338742226507FEBAFA3743C26BE52D5536038C931A534FEABCD1E845862DFC494B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Era Setup 1.0.120.exe
- Size 146.0MB
- SHA256 8e15a6f861aaa8e93bb26d192f6f7cf7bca9a7538b734f1bccb5c4074ffaa1ed
- MD5 66a8f152e073fd717df29bad36cb33b8
- SHA1 18849fcdd6c9a04c8b88927fb2d664b8a3e2e83b
- SHA512 8e55ba6109b26d7b84eac1452d2ad782c7d5bfc039eadcf13c72fec486b1bc715e1169498c25bf06594f573f33803e1bbea899a3af9f3472e5736f506d66764b
- SSDEEP 3145728:Ntw+poKrRnDaumGWLWsyK9kEv/LKPXD0XAgdRnD5:nxpooD9CLWsyK9f/uXkHzD5
- TLSH
  T1D178338742226507FEBAFA3743C26BE52D5536038C931A534FEABCD1E845862DFC494B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Era.exe
- Size 201.1MB
- SHA256 2940204d30f2878d12046531df65f06e6910ba1f0751b86d4422c6fceaca2130
- MD5 75c182ba22cf08b2fdd84da7259fd36f
- SHA1 5a6892070047bff26a46ae14aa9aebf3d4107d75
- SHA512 afc98f94303b5f5a152b257704bb11bc66a15e7094e65de8f6c0a1a536becc11235f2d3b2e47e04146d3caaff0ddeb11a82a09ed506c5ca94cf5d9145ce8d146
- SSDEEP 1572864:5Pfm31RV7UxMlZE9keIhkYLc7N49dEK+5Gof9IP554PxLom+gsT6BwLFFagWLmIR:loba28xLL9516bAM
- TLSH
  T1B7A87B03E29A41D9E06DD175974A9633FE71B8094B24B2DF2B9407522F77EE42B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH
  T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  binaries/FortniteLauncher.exe
- Size 52KB
- SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
- MD5 aeaa6f47b71614437c0d47828da005ca
- SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
- SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60
- SSDEEP 768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb
- TLSH
  T1CC3362D43AA89CDAEA10527C40FAD331253DB6E0865347576A30B7320F13BE17AD725E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  binaries/vulcan.exe
- Size 83.4MB
- SHA256 2e1bb038a933dd45d99c1db563895e39a97985ad09fc6df473db69025d545320
- MD5 852265419e7d45c999833da73a893b98
- SHA1 9fb9d95cf6bec2653d4fad4cd3e5d79b9366c9c7
- SHA512 76c8f0c85dbcdec702fd6c3b99a4e27110fa71b28e646a05ef9515e10b0a7e2d7b1bde84b37ea350f5a4472930db17671d4c11207183fe151252a6cef257c3f8
- SSDEEP 393216:SHiF+q20mzccIxl0UrOAdSP6XBCBnIOGq2h9Yg2ftV5kwVAliXUxbblHa93Whlit:SCc6c41KAd9XBmIOsmtBNBb
- TLSH
  T15E186B02BB9B5499C06AC47087C78623AA3178CB1B35A9EF758C47352F7ABF45B39314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 aca2fb078fe994aa3cb7773d5919c8822c94398f216371f214045ffca2a4320b
- MD5 2f5501f38f1a2f37ec178b9059d3bd55
- SHA1 f0092390a8a14d2d04a45101e64cafc0443fd7f8
- SHA512 7ed07ad76368ef627b357f1544e5425090665c33c1481332c746093404aac3ae8acde134342a8ee4d30472eb31176d06049e7abb8d4a44aa9ad93bd3375b20ab
- SSDEEP 196608:KINfcxXBXSsTP5HtTz2HF0guYYl8Cqe59luxQpB:KINfcxXhSsTPduubGa9lu0
- TLSH
  T1944729122246D49DF059C878C3678616CA6C34E73FA778EBC0B461252B7BEBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  locales/th.pak
- Size 1.2MB
- SHA256 45a573589f11c1694490913c00bbff65d57e232d33ca2270ac2e443207b971d2
- MD5 79b81841fde5ef8edcb46d2ba86dca09
- SHA1 7d9fe5a44d137dd4cecc6009d597f77587e84c7d
- SHA512 31641437d3c012ab0a88db26539731c7c60d141d10646c4b457691c0827f0a0459adf479579b52263e6d4c46728642cceeaf6ba59a2249ff76a4c7bd5c59d056
- SSDEEP 12288:lvJJLN9LyZYAhzYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4B1qsl5URqE3D:9J0O5Ssf
- TLSH
  T114453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
- Size 8.4MB
- SHA256 afbcd1d671e55c567212f1ded3870fee4d5ca4624fd1016d4f615c8775db48f7
- MD5 da814af1129166350db6fa57d4412756
- SHA1 b6a0d759eae3260339b0618518bf511a691d71fe
- SHA512 536781b6ddaeddceea0e75d93e07097c1930c308688886c263197ce67d2037303e06a35ae5e35fbac84edf1f2e9a963551660037f25d204011e99623d0bdf4ce
- SSDEEP 98304:1Mq3kiKVXD85sItza4CisgwXylQ0z2rjLQ9JOwzhv7QGEVDeoWnOU:h8NSsGaYFz2rjLQDz9sGEkZr
- TLSH
  T164968D03F2A841E9C0AEC1B4875B9637EB72B8894621B35F1BD44E722F66F605F1D349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-140/register-scheme.node
- Size 131KB
- SHA256 2987d5fb0bfd8caddc01020f43b0afebbec60d7b492c4b03fad81f03ff4eed7b
- MD5 8edb11f406324ac88f6d6c6af225d9c5
- SHA1 897679a7cc43d2945397c75f117033ac16e4dbf4
- SHA512 f21fcd8b7e8a80c7e49ba91e6c44e424e73dedfe945eaf9d72bf66971893ef89d35edef5d1df7c7c996c5e0ac84fe7a4dc04abb0b58c673ec9f2298714dfbcf5
- SSDEEP 3072:r/xHNMR+73ZNNoNlfCY+pFZ7ncxImp/NiTnWvbP5TXr:rsR+9joGnpTcxImp/Ni4dX
- TLSH
  T10AD36B1B73A100BFD4729239C9632A05E3B3B85207718BAF0764467A6F677D09D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 131KB
- SHA256 2987d5fb0bfd8caddc01020f43b0afebbec60d7b492c4b03fad81f03ff4eed7b
- MD5 8edb11f406324ac88f6d6c6af225d9c5
- SHA1 897679a7cc43d2945397c75f117033ac16e4dbf4
- SHA512 f21fcd8b7e8a80c7e49ba91e6c44e424e73dedfe945eaf9d72bf66971893ef89d35edef5d1df7c7c996c5e0ac84fe7a4dc04abb0b58c673ec9f2298714dfbcf5
- SSDEEP 3072:r/xHNMR+73ZNNoNlfCY+pFZ7ncxImp/NiTnWvbP5TXr:rsR+9joGnpTcxImp/Ni4dX
- TLSH
  T10AD36B1B73A100BFD4729239C9632A05E3B3B85207718BAF0764467A6F677D09D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/index.js
- Size 91B
- SHA256 9740d6b8f1290751808b9474175259aabd1cce2064ea6496b900b8bd9e1a6cb3
- MD5 72c672f572f5bc3185b3dc87a245123d
- SHA1 dcd3be3fcfcdb2bfb4e4ed04ec8b04d430ea5833
- SHA512 bb2569d1a9a8d41350058863ee8cb8c066a2046092d93e7268b48574dfc4b9bc54513b3ca9dce10a75a71400ab9c2149334f243e44b62700b0f11e1bef9f1cc4
- TLSH
  T130B0124DD046E2DB27C420C8AC625403894EC111803045C1A304D7C40CA64C05102960
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/binaries/FortniteLauncher.exe
- Size 52KB
- SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
- MD5 aeaa6f47b71614437c0d47828da005ca
- SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
- SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60
- SSDEEP 768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb
- TLSH
  T1CC3362D43AA89CDAEA10527C40FAD331253DB6E0865347576A30B7320F13BE17AD725E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  resources/binaries/vulcan.exe
- Size 83.4MB
- SHA256 2e1bb038a933dd45d99c1db563895e39a97985ad09fc6df473db69025d545320
- MD5 852265419e7d45c999833da73a893b98
- SHA1 9fb9d95cf6bec2653d4fad4cd3e5d79b9366c9c7
- SHA512 76c8f0c85dbcdec702fd6c3b99a4e27110fa71b28e646a05ef9515e10b0a7e2d7b1bde84b37ea350f5a4472930db17671d4c11207183fe151252a6cef257c3f8
- SSDEEP 393216:SHiF+q20mzccIxl0UrOAdSP6XBCBnIOGq2h9Yg2ftV5kwVAliXUxbblHa93Whlit:SCc6c41KAd9XBmIOsmtBNBb
- TLSH
  T15E186B02BB9B5499C06AC47087C78623AA3178CB1B35A9EF758C47352F7ABF45B39314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32