49a80ad5c0053175eb394cb4a96490490f8ce98e0215e83c5a65da4ca58ef16e

Sharing

Copy URL Twitter E-mail

General

Target
hakkoai_google_pc_US_yidian015_&W7682114449930493952W&ai.exe
Size 119.7MB
Sample260905-wsbrqazcpd
SHA256 49a80ad5c0053175eb394cb4a96490490f8ce98e0215e83c5a65da4ca58ef16e
MD5 036370a7a196e928fc0d84f309d6e6ae
SHA1 9c10dbd811a5b642e9d6bbba13464bde94c1fcfc
SHA512 55be81bd3c2de4cb545ad18fb53ab06e3cabfc8ed711bd30bb620e01d70f39eaa6ec21f0507bf05f52d52ca6088632ae5df8f33e3e653272372a5def327bfc5a
SSDEEP 3145728:deujDFMInGWKicuappnG9jrKrbIJT2GSx/y+OI+hLAIKeqBdyL:d7qInGlicuapI5rhJT2EhuBiL
TLSH
T1165833D6BBDA27FCEFFE2775012B77BC40836CB63A0177FAE9406E5A045407214A8562
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  hakkoai_google_pc_US_yidian015_&W7682114449930493952W&ai.exe
- Size 119.7MB
- SHA256 49a80ad5c0053175eb394cb4a96490490f8ce98e0215e83c5a65da4ca58ef16e
- MD5 036370a7a196e928fc0d84f309d6e6ae
- SHA1 9c10dbd811a5b642e9d6bbba13464bde94c1fcfc
- SHA512 55be81bd3c2de4cb545ad18fb53ab06e3cabfc8ed711bd30bb620e01d70f39eaa6ec21f0507bf05f52d52ca6088632ae5df8f33e3e653272372a5def327bfc5a
- SSDEEP 3145728:deujDFMInGWKicuappnG9jrKrbIJT2GSx/y+OI+hLAIKeqBdyL:d7qInGlicuapI5rhJT2EhuBiL
- TLSH
  T1165833D6BBDA27FCEFFE2775012B77BC40836CB63A0177FAE9406E5A045407214A8562
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- Creates new service(s)
  persistence execution
- Adds Run key to start application
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/physics/cubismphysicsinternal.js
- Size 4KB
- SHA256 9313a1669cd18c0032dd20a5c5b33d3a89273334da9ffdef49608534a9ed23bc
- MD5 4deffb979a2954cf1a5b82b0f118f34e
- SHA1 6900f036d619e5427964f967213d3efd300b135a
- SHA512 cbc706e43144e4e5987cedcc7260dc54baf37adaba14ff40887d4539684a53feab98914560dc25bae3d36a686e486c8ed00d4517d9a864f6e824db48df3bac3a
- SSDEEP 96:3tXBdHQFmjDZGYtlCniRvnyeHkWH1jqDVlT4XzptFBG4DhpBl4lNu:dXBdDxeBB4wNu
- TLSH
  T18B9110E6B22473D554B362EA6A82E984E120908B7A02C1553DBF56701F61DF1EF02FDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/physics/cubismphysicsjson.js
- Size 18KB
- SHA256 fd7e0d8fcb3a399d3a128677c58353fa3d317a620fadc0dcc1beca672460a35c
- MD5 4605c2637daa70986abc44d267bc0679
- SHA1 f83e55402ac080b5d13c488e1dc4870fbfe5e26c
- SHA512 e7c1e5adbb71d18409dc551b92aacfca271046e12011f1e8e28211944f47b8adce9411d50b806a6056d2021fb8ae2ae07a1a70f67db728daa09d27faa36493e2
- SSDEEP 192:dXBYdJxGlmJIm/1zCZEvuEjaLuLP//+/H6p+mDhc6XbvhN65Xs6h/6X16H2a2LaT:dCdJx/kZWpxDhZThKXs6hcmXWvrcg+1
- TLSH
  T1E0828D57BDE3501C8C33327A6205C911D4195B9FEC22E2A1FC5C2E286FF458BE6C5A75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/rendering/cubismclippingmanager.js
- Size 27KB
- SHA256 448d4e9a5606384bd64cbbf4f6596979dba2b8692353dd1f3a153cc07ff065dd
- MD5 97e7d040df8a0e722c97704513b07680
- SHA1 554f2bca50dcf82da3ec18a54bf5e891cafd13da
- SHA512 bf7ae0eb188ff11ccb75cabd5d4aba5581e0d69d1b85c228b8b598785a06968f37e8ae4eae9f5cedb5be1c9ebdbc52e7866cb7d225e17bc82eb09a4446abb310
- SSDEEP 384:dRzxJwZ6FXymUml9lzWeIz1oDEzGOemtjnHz:dFwZPFElzWeICEzGOV7T
- TLSH
  T143C25F2ED37920056D3623B29B532840DA239C97FE06A279795FC59C1FF417882B8FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral7 behavioral8
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/rendering/cubismrenderer.js
- Size 9KB
- SHA256 7f22706fb42a7f7c48369061ae96762b2e001f4454688703d1f3377a1e7c5655
- MD5 9d06994d5a0d799643bffb147c9bc2d8
- SHA1 b35af65a98eb885a8c4aa7f422d3925312dbba13
- SHA512 77136ee46cd7def5af0ab0f3fffd302eeab05866aabf096e2fb186fbd2dfc39c0910f8a42a0730ba2f819145e95c75a52a83f7e1ec6cdeae4e74b097e8a367a9
- SSDEEP 96:3tXBFsJAKQbbA6njO5kqx7sFQcixijn+BnREvTH4NDtjialLYsTF8VK2UVJjomPy:dXBw8b3jc7TU65TI/OiiYNH
- TLSH
  T14312446E1FD92463453AA3B64B221481E1329E8BED0B2168BD1CC5F87F34BF99024F74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/rendering/cubismrenderer_webgl.js
- Size 33KB
- SHA256 a7ec2436541eac7f53674daa0f2cc89ede5a25ffd61cfd187c9fa36e95754845
- MD5 d0e3192864b8bd6163b4d2148877bbab
- SHA1 cd67a7467dcd8ea9be6e937f6a306cb1f7493561
- SHA512 c728563c3219adb1d1bc5fc1e6eb107c2550b810ba60ffbb525668a327a919abcf9d875f110c38fd510316e7117c9276ee0b3c2f883350e0557bd7e58de09672
- SSDEEP 768:dGXgg34dWwR0R2g4ZNi9ZzMlDlADUlOVmZ:wXzIU6NXlADmOV0
- TLSH
  T190F2302D47AA1812883653729F271C8BD1124C4BED47A27E390DCAFD2FF957891A8F71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/rendering/cubismshader_webgl.js
- Size 38KB
- SHA256 4ae03f8da561c2c2c40103828d4a3aac8b83d0c15a58485ad76ea31210b9af1c
- MD5 52ec886d597e6bace3bbf68ad7c793e1
- SHA1 6423a053af247bf303dcc61147da4fe27e35016c
- SHA512 de2a7c32018d8ad1d57cba9384afd412ea3f71a96a98623566044f5021e6ca3b3d417ff06aac7094e64c71cecb7244683b8011cb1cbcaaf78369b63519f5a819
- SSDEEP 768:dzSAWuCdWNSA1QZLuvHjMzVZafDvo3B1WGDFCds+upAuKVGI+b:lSAWuCdWNSA1QZLuvHjMzVZafDvo3B1P
- TLSH
  T17E03C19FA2D90568897753578B720D27C12EE4AF9406820DB40CC49E6FF8939DA3DF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/type/csmmap.js
- Size 8KB
- SHA256 a94ca3ebc47d9489daebc9543022026fd12985d76ea17ad2657632189a065c9c
- MD5 9bcec32893c9657ac80062d6d7a4bc49
- SHA1 ffd82a704c90a3bf67bc6d4f26c56cbe063e3179
- SHA512 615e02fb83342c793d4f92297f4646926c34aab965cd4af5980dcec6861b173b60ec0bde583c6169950520dc43bd4d3165892d770eb123f285b4969c7948eae3
- SSDEEP 96:3tXBG02S97xJmVXDDRDK7NxdoeoFjuIIQ4O6SGRQtT+w0s1VSUKBVTT4X1xcA4lq:dXBlHCVXmuem6dQtAJjX1NA
- TLSH
  T1DF02334F1AC5201245317372AF564420F9754E3BE65561A8BC2C82FC3F75AE8A1B4FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/type/csmrectf.js
- Size 1KB
- SHA256 243d62d09e5dba07fd3bf568f43a5a7a3dc34df7a029900c16c6efcc31057de9
- MD5 e2f3b2818367b86349a6e24abef36dc6
- SHA1 029a23cc443280ca41208dae4afaefd70f2a6002
- SHA512 5468ae0e9e4582a22c077d1bacb535c7d0c13d55ee6e39485e4489a29597c8bca03e9ac84c4236cf9c50b3cff95e8a856785ebc3fd098fda864cc7bdf7e7f398
- TLSH
  T11441BB5E0BC9601AD2359273AF46A404E622D96BFB8B20D87C7C1BF43F707E05128EB5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/type/csmstring.js
- Size 2KB
- SHA256 e7f5acbd83058be7ff507773212ce853f2372ada4a5eba3d74cd8d31151423ea
- MD5 3e7aebe6f50ff7f06af3cab86aa8c1bb
- SHA1 06975495bcc74e8c1b42c83945a581530dfdc6b7
- SHA512 0c707e4a35bce6442b47031c6dbc5bf65446e1553f1580da7224a20c9199cab22bb85b6f8741086cc5ef5fbb43f57a2239a295de04397b730357310e713b1bf6
- TLSH
  T19D51AF4B3BC6B61551BA53B5DF46B441F028AE2BB98921F4BC2C5A722F307D8D1E4F84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/type/csmvector.js
- Size 8KB
- SHA256 95613d47abdf746c1ee50bd3e43aefef1705180cffa0b8b2213155cced889fcd
- MD5 b99be3460597fdb832c11091adf95347
- SHA1 9ba6fb6ccf3c010f790b7dff442689fa2eb359d3
- SHA512 1b60fc38f9f05dad0c0311b1f4ae721ee570ea86a892d35aa36cf4e9380e7e952d22c86b07d6aa16ab3f52ab570094c95da06cf104358373291a8d504940bd8d
- SSDEEP 192:dXwx3ZG0s//uq2VnEPiUwHsKOTA8fgh7jSaX81NL:doAT/K59MfA8fgh7jSaX8bL
- TLSH
  T118020E6E0BE550028632B3766F534480F97A491BF942B2DCBC2D81F87F746D49225FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/utils/cubismdebug.js
- Size 5KB
- SHA256 810fefe881b304912d23a709f7a0c308b97657c0bf70c4529bf51507157a4352
- MD5 254a18b5bed72099b6c03bb49ca650bf
- SHA1 2c175f1a97763954e128881b426b700cf8496fef
- SHA512 3a584a35b862497ed7e197e516dc56803d8355e93aa6654cc3bcd943a3b61a045b1109fdb08559bb2c431f17d95f17de77627e1b56872f3c1425b16cc9c194c7
- SSDEEP 96:3tXBKYe0ZyBNe5IBz4w1JrJf9MJDZxJISHQJoj2cVoT4XD74lNF:dXB1a02acNF
- TLSH
  T157B1CB2E27E109E295B136E927026C56E4220DB37897A9D87E0DA9741FF3F749450E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/utils/cubismjson.js
- Size 30KB
- SHA256 f2e7050f5bb7a551a6824e9bb62ef2afbc9eda06d805b2b59225f0c62ae9f10a
- MD5 c3462073da10c21fee0b982c9a117ccb
- SHA1 32bc22d010445271271b2cd661f38a3c2dc28fc4
- SHA512 a8a1a860c8e6ca400b9d5794b2f9f733b7b4fcabb11c2a001e35832fd2a55b0603139158ff73fb814d4229549e5513a3f5599b5de0b53906aa3488d948c92f4b
- SSDEEP 768:daFv4GqU0vKXlSLTdR2G/uhJO9JFFddVhdW:AiGq7alSLTPZmv4JFFddVhE
- TLSH
  T1C9E2514C2ED270220436B37A8B979041E93A4E6BF61461E8FD5D86B43FB0AD5C1A5FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/utils/cubismjsonextension.js
- Size 4KB
- SHA256 c36238862b1c65532f6fea9dcd44da9ab9a4989f07e11fc5a6c19a3088efb3c8
- MD5 add1bfd36e7b01b1dbf8a1d7b947aa59
- SHA1 b8693fdea6327a8a3bb971eb2c0c9da25c906ce2
- SHA512 41bd59ffd4ce31f60d4d8d8e6102fc787780bd39cf0fe927c75c37298fa6dae3241c91bf12a2a575dc69045ebe3c2f43ef4080ace24f7173115e02bff93d3a69
- SSDEEP 48:3mWEIA+H9l2YUa+TLzTIE/Bb6rGbbFuGbzPC5FIfPjzSrGbLF6GbTPy5NGbbFqGx:3tXBfmzTI+FtP8IPFdPXF9PwC
- TLSH
  T1B3919D041DA701615C3BA7F1869F9005F93E6537E16263BE7B4D75A01F32868C3A2EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Assets/Web/1.3.1.0/cubism-sdk/Framework/dist/utils/cubismstring.js
- Size 3KB
- SHA256 e98da01f27d76c34bc27cfc7906b082c106731ee343eda34c8692c372d668b64
- MD5 7ac0242f2460a3c6d8d4a7fd66608f42
- SHA1 903195b2755a6926a22b886fdb6cf79a1c03efe2
- SHA512 0c2437e79858bac0cab9cdcffd729cd05a9751cd8370e6b81e87a91d7255581491e95c76adf15501fdbeef63b675bbf3957b017e34509fb523e173e00d5407db
- TLSH
  T13271521F6A9054210536B3E4DB869168F538A93BF9045195BC4D66703FB0EE6C2A4FE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Assets/Web/1.3.1.0/index.html
- Size 461B
- SHA256 0626216565dfaf3480172ed4605ab0ba44bfd762d03fa5ab08b03fe88617da3c
- MD5 5ad5b710796429a1b98d2c668a8db48a
- SHA1 728a0183ad9df0c55ddade842ddd37be14932424
- SHA512 02e2f2bfc20bde8367c7e2bf49e04b45ac47851cc337c9684ca5629f915c4fe32a199d1ed2cb53b2b6505185bbfd9cdeb3199cc4a8f2d9beb9e5ccf93fa0a6ba
- TLSH
  T1D9F05C4A38809E4B03600B6A4DB2A15C66578F5AB345AD2165E730772F8278ADD9E474
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral31 behavioral32