db0bb7fb1e580cf4e83796e12753fbcf8c48043ef5518ee7446656d73ee8eaa0

Sharing

Copy URL Twitter E-mail

General

Target
lspdfr_049_9695_setup.exe
Size 70.6MB
Sample260905-ncnscabk6s
SHA256 db0bb7fb1e580cf4e83796e12753fbcf8c48043ef5518ee7446656d73ee8eaa0
MD5 c8f0a13645fd67ba2bacf1c5c097d220
SHA1 5ec235284b9810984d36dfe207bbccdb3cbf11b7
SHA512 e4847ba0311b21122d9f849eb31aae9851c5ea2d0940ad072f06c1f8c9af06ab52e373dfeb89e476235eb738ed6e1e09d220b3c4de79cf78765799a374feefe7
SSDEEP 1572864:Jm2MjihaB7zpS60O/em1hPjSsOJ1le9doNUMrE6torbj:Jmihu46LvhPjEe9yKNZ/j
TLSH
T196F7333268A233E0DC463D749D64ECE3EB65D5F79E96081953297CA63223E4FE1148E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  lspdfr_049_9695_setup.exe
- Size 70.6MB
- SHA256 db0bb7fb1e580cf4e83796e12753fbcf8c48043ef5518ee7446656d73ee8eaa0
- MD5 c8f0a13645fd67ba2bacf1c5c097d220
- SHA1 5ec235284b9810984d36dfe207bbccdb3cbf11b7
- SHA512 e4847ba0311b21122d9f849eb31aae9851c5ea2d0940ad072f06c1f8c9af06ab52e373dfeb89e476235eb738ed6e1e09d220b3c4de79cf78765799a374feefe7
- SSDEEP 1572864:Jm2MjihaB7zpS60O/em1hPjSsOJ1le9doNUMrE6torbj:Jmihu46LvhPjEe9yKNZ/j
- TLSH
  T196F7333268A233E0DC463D749D64ECE3EB65D5F79E96081953297CA63223E4FE1148E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH
  T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  DdsConvert.dll
- Size 14KB
- SHA256 d115d8c9a817b67c3cd042e51bb941d74539dca655de7be8a3cbad058d3b2764
- MD5 65e684e0fd64493392436cb92617ceb0
- SHA1 91e45ee7b5ae223dcea5c6e9b78e06b238473525
- SHA512 0f0040884de91b3d9b94228c8af8ba632d9e907f64b725e79b1332c1e91a78d157cad8480b5a3c35c6534d1ee169a2e0df459787f153b5fd211fbc9f94832b82
- SSDEEP 384:WdbEoSazDKL3gtJrgLekkzcwtZOZC+fRzmlg:WdbELazDKLcrgLekkzH9+5ie
- TLSH
  T12462A5D8DA4B21D2D83D2F7C69C3B1C152A450C06A72D78D64C7A7EDE03A731123A6E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DiscordRpcNet.dll
- Size 6KB
- SHA256 952605857477708168dafffa8e9879494f9832cf979a5b116daa3d903a154569
- MD5 65c8b3ac6205985288c4ee507481cddc
- SHA1 70c365d7a4ba6d3d5b851d5426db04e9e84c5c7e
- SHA512 481cea35dd03e8981b9d2b67b7372cde8ed34e214249c3eec87adf43c31dd19e5eff07341cd445adcdc4be2fe3497320dd7c86993440f7774d76e373261f7645
- SSDEEP 96:UbVxaHt3VVOERxXkMH4a6/Myu2l1SUtn4Xbtmd:UxEVVrRxdYa6kyu27SU54Lw
- TLSH
  T110D18315D7D84FB2EDB393B6BCDA03816378F1404D27DB5F088812AA6E592104EA1F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  EasyHook.dll
- Size 51KB
- SHA256 3153844bdaee8a55c812d072b0e25f992e716174fc7d987944f4b8cf6ddd1f83
- MD5 163e0d2a3cccaa53f16bf5d41721730e
- SHA1 b3703a4a13f37ec342c1909e7caf30a7ac9cc351
- SHA512 d818d5934b47a2a661e5ae5fbe9ae03ce837a43da9c8aca39424e8ab048af6ea36c9bdde06686b82827caf7a2c72544ce895d6e38df73d0c15db281a5b771dc9
- SSDEEP 768:MefS0XbE5h5Efo0MisZ7b6y9YVAdB0oP4Ng+C+ab0d++XyCs4ff/8h:5IrEw0MjZ9YVAd6zNPCvbq+Gnfw
- TLSH
  T14B333A0473CD8626E3FF4B396C731B5283B0F2826633EB5A9AD0512EA857BD54510BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  EasyHook64.dll
- Size 303KB
- SHA256 62842ecd61d855199c086600526b697941dcb56a10d4d6ef7d610ffc6369f6d6
- MD5 2d7a7ddd6f7ebf32543d851d9a55f60b
- SHA1 8d8462ff56a76e5ed7a07388b6ef2c57801f6d3c
- SHA512 72816390b55b131103ea6f8a3ffdff7e2644d46a61c87d6bfb12d81b990c44d161d6b33b0f9883e46f3d4138c3bce0f9deb6047e07ebab42f95c0cc7777e43cf
- SSDEEP 3072:jv2aNPhAJTvp///PgixvbhK2MX6jNPZIKC5x2BQiZWIpB5gHMOirYGZdYY32k9Y6:jv2BTvpH/oivlK1KtZVCWyiZqsbZp3D
- TLSH
  T1A1642916E7E00997FD63963989F309529A3278546336D7CF06B0021DEF2F3E26A36725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  EasyLoad64.dll
- Size 7KB
- SHA256 f7766c70b4c82341f32783c72b2ce1430aae95c6d713a3431daed7b1f4e40de7
- MD5 0ee88c5ca0bcfdf02290f4b87f8b9a7e
- SHA1 fbbf3dfe3ead224808a1a56622bf15adf5d5af72
- SHA512 14cdd4172dccb572de0720096b5c3fd0bb360d83af250308523a90e4bf64de3fd06544e3146c516b554e71df82b74ce5609d48960e96d7de5804a1beb92ef497
- SSDEEP 96:1LOmct6LHl1zCybgq0k7uQ52aYbk0ohzrkwfy0pJKX:1LTct6LHlZCyb/aQ52x3Gz7BJKX
- TLSH
  T140F1E712E7E98B76C87B4B3D9833A2414774F7129E23C61B8ED4560ACC96388AF71375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  FW1FontWrapper.dll
- Size 152KB
- SHA256 1ba5bb9ffea32a8c30b5c8b7139e15ddc36a43130465b4d1ce4c7b77fa6fce25
- MD5 daa32fd4ee493fc1fdf0b66991868ef4
- SHA1 d4184c92b83daa70972723a455912768df1bd1d8
- SHA512 ccb32ef87e4ee7a09fb2d6fa10c21bf411f16f94bf34ae6728057c0be052231ad1a799d77ec73f5193f36044d3eabdec70b8c618dfad47001a2b58ee91c3325a
- SSDEEP 3072:Cve3fyhmCM5WRe+XobT4YHI2ebmXgCkWa/kWHXcU/c:xGE57+eTvHI2os7DWX
- TLSH
  T1EBE3175A33B940A2D163927C8EB39A06E77275914B3593CF125443BE1F63BE09E7E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Gwen.UnitTest.dll
- Size 41KB
- SHA256 cf68f7773feb5756e050a4503f142c67b17c1e4becf23a878649960b58259017
- MD5 90b34cfce1f4caba67f42f4d8f135189
- SHA1 660409c7ff31b7ece22bbbde0bca89cd818f8ef5
- SHA512 6833fc7cf62ed8342ad8c8cd06ba6bca0d769b0ca231111f7c1627040ce70cba0c530ce50c2bc5acb105e4af211e7a9c1ee7b45969c63a5633770c5f75b52f01
- SSDEEP 768:5eNvuZWDvclJlVPPRlNgPQPZ1XYQQs9+7+yNhR0sU/mjBzTQBfG:wclJlxGPgZJ3d9+7+yNhmX/aQBfG
- TLSH
  T13C13A51837F48651E4BEE7799AB26444C7B1B90E9931E74C0ECA18FE2877F528984F13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Gwen.dll
- Size 191KB
- SHA256 33275af76fcd12157732a80df4795590d409a1df46b2b32a5112ca11d6aa5267
- MD5 367a1b17121dfc7c2347984380939bc2
- SHA1 5407a022865656494b3427cfd22d72c2d6965819
- SHA512 ff79cb21e08cc4825e1bc20f7938965ba5f09c8df60f9c21e1af11f58742f596daef30e762950171be447bdb772334234e0d0b7e03f0ffe30ac0822fba69c0cb
- SSDEEP 3072:6LGNlqI9IIjDVjUhNOkDRrQXwwZsiaMDGoaAfokaEwYGpZ7hxrZI6rdOW4K6lmuS:6LqqIVPVjUhNOkDRrQXdZsiaMDGoaAfv
- TLSH
  T133144BA4132C09B7DA7F437CE046A029C7F8E652774EFB755D8B68EA1C47F9089050AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  LMS.Common.dll
- Size 14KB
- SHA256 8d5593abb8a939519365293d3325b83428f8304b56c59cca37929637e7d6fb50
- MD5 61dfccfc5509df7e88bc4ab7eab982e1
- SHA1 cfe2d5cdea6de139f16a82060ffc238774d8b052
- SHA512 867ce9a2ac3d609e1fa4e7360498ce1fe3e09d03560c1244ca7154c95877267a2e96b47fe445a76a739db0483c7d70fad2b3b4ec72d203266d27e641c25deb9b
- SSDEEP 192:SMQ56I02C7XIMJcXXRF/qlGsVmRK/ZPpZGJ3QICjZfvGenFInAmJVA:656IPekBF/qllVPq/CjXnFrmXA
- TLSH
  T12952171FA39CC3B6DDBE0AB8A8A741411375EA57B547E35B4DDDA00A2C333181A61B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  LMS.PortableExecutable.dll
- Size 60KB
- SHA256 4389b18342461cc11b48ec7a35c76bea20beb0a76724ba77c2ed0406e5517ed2
- MD5 6a52fa924073b0f913855f070dc553a7
- SHA1 6f28a3f65608796497f4765b13b37ebcd5fbd804
- SHA512 5548a02bbc7b1104123d7adf14881b83b6f961c2c68ef870ed0b2f16587d31f079c783c67a3efc7114a0cd21a13202dc01dc572ef15a89141ea4e9f6dd8a0ddd
- SSDEEP 768:7L29L0xLEbfbLV0ErjXXYV0xCXpoYvpbl4+DFYQWySk78fC:v29LSEbfbLiErjE069vpbl46BW1kAa
- TLSH
  T137534E897660B2DFC85BC976CEA82C64EA61647B530BC303A41716ED9A0D9DBCF111F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Microsoft.Expression.Drawing.dll
- Size 141KB
- SHA256 1d69eaf538008e0fe1a7eb2ce0124a49b95c491797749640c8351ed4643f5c97
- MD5 5bd39a82aacf1aa423e6eeeeda696eea
- SHA1 b7971f9807520dac9523bfd1185a7dcc9e5cc77c
- SHA512 cbd255e7323a7e82d8b9443e8ce67bef88f88bf46e525333e4017024a31952656f61f93334b3957d85fb0e422e561197c0adb1366653da007c9667651b1f37b1
- SSDEEP 3072:0RZlEOzBzB3yZwUDXSNhB+IIx3zUOEF7xQQwQQQQQQTreulTnXGZFfHjKUhcweTo:0RUONhhUDyhB1IRUOEoUjHBhT/nLN
- TLSH
  T1EEE35A2D03A8CF33CFEE7678786051065B30C7B7A242E7556DC4A2FA47937620A825DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

ConfuserEx .NET packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32