00101254d871e5fbdce271978b3c68bb3a95a77d621f3888bfb3ecc20ec0c9fa

Sharing

Copy URL Twitter E-mail

General

Target
Basecamp-setup.exe
Size 97.7MB
Sample260907-at32psam61
SHA256 00101254d871e5fbdce271978b3c68bb3a95a77d621f3888bfb3ecc20ec0c9fa
MD5 345612cdc0f1385103d4e2f9b46e357d
SHA1 b0172ea3a0e42396d68357f1ccf3853069bed832
SHA512 5630973e4c36504f6cf704bcd9659ca18a77218befb0017ac089f49c45fd80c453981c941d769295ffe538506139b89628df95240eb1937af338cb4bbb541e65
SSDEEP 3145728:1kMM2NPP6synzGi0qTh+71eOR01dOXuHdm:a0H6sXi0qT8naI8m
TLSH
T1E0283362D5C7846EE5C10BF32853A41BFA972D73960A40D29BCEBF16887D0672CF3256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Basecamp-setup.exe
- Size 97.7MB
- SHA256 00101254d871e5fbdce271978b3c68bb3a95a77d621f3888bfb3ecc20ec0c9fa
- MD5 345612cdc0f1385103d4e2f9b46e357d
- SHA1 b0172ea3a0e42396d68357f1ccf3853069bed832
- SHA512 5630973e4c36504f6cf704bcd9659ca18a77218befb0017ac089f49c45fd80c453981c941d769295ffe538506139b89628df95240eb1937af338cb4bbb541e65
- SSDEEP 3145728:1kMM2NPP6synzGi0qTh+71eOR01dOXuHdm:a0H6sXi0qT8naI8m
- TLSH
  T1E0283362D5C7846EE5C10BF32853A41BFA972D73960A40D29BCEBF16887D0672CF3256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Basecamp.exe
- Size 216.3MB
- SHA256 c4f0610fdb05b58fa2bb888c1730b6433e53433b9480b96dba2015c585f6d09f
- MD5 5d0335af2ccda797f8c20736e55edd9e
- SHA1 9678c529849c4e4f4c6ed1a2d12df937581d31c5
- SHA512 7fe59006d944acf1017953760e1dad2390b120141c0d853475bbbfc65dd7176a07986668adfe3671ef9033ccfa66514a1b8ea3390fcd70b27bbfc0a282f3e0b1
- SSDEEP 1572864:JWjeeQ23/vX6bFo270duhjeht1vcTo63TqxdFomUVkxFKdijl9IVzQMUa14Ezgih:i5E0BluHNI
- TLSH
  T1F5B88C03E29A01D9C05DD1B59B5A9733FEB1B8454B24B3DF2B5407922F66EE82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 9feb01af5460d69042b715dd2dc8d23faa3a409b07b811e07b7195c044aac1c7
- MD5 738d9cdd6a94cff9e941326c6c2ad734
- SHA1 716f6bc8a11dd0940f1b36196ad0a1e32c52a886
- SHA512 6e1e188a6a07fef8ee96e106ffcb90a6dc13ff6fe6b313797e4c746a9a4fb7a0c795a3365a9fcf0a1d8918d1fbd07ff9f583bb4acd17d883b09c8b5348abff97
- SSDEEP 196608:dWxkDUHlgJWwgvYtoexSGkJ+ccXP2BPUNkiAqAN+nNtbR:dEkDUHl4Wwg2xSFJ6XP2BPUNpQN+zR
- TLSH
  T14A4729122646D49DC099C879C7678B268A6C30E73FA7B9DFC0F451252B79EBC4B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 568b4a799381c45e34f7ecdc73d7ffc4340688153766f5e6d15b7d99ca8a47ee
- MD5 054e6f1d8554c25cfe74cd8c625b825a
- SHA1 f50b4d25ecd8ff11a148bcc52e51831130774b84
- SHA512 2b1a7341c09fc75477d62b43a56506bc9417a98db413cf57235f64850138bbe34a9ec30147cd55be648134cde56100524f9a32ab90c84a3b084fdc1ab1f396fb
- SSDEEP 49152:YD4JOs9bUAtjcqOEYcvDb199aPLKIbH7k6Q4gNoJqFfwYd7f:YD9+UAdcqbvDdRNoJ23
- TLSH
  T1F0E59E02F6D651DDD029C03497AF9213F631380A4F205AEB1A905A263F67FD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libEGL.dll
- Size 496KB
- SHA256 6f7c54b18fd4db3bf1b6ecdb0a013c557fef8b69d3ddc58c1413015830833436
- MD5 78360f358707e3bd23200f081a10067a
- SHA1 7221e6335e9871fccf2986b01da65c343dfbe698
- SHA512 8a2b88e7e49ef83f99950604be644a1eee13a35b98d7bc381226d40b479c26e51a2f3ffefed9cb8f73fbbae13b82add738fa3ee172b3aecd9176b88eaf96509f
- SSDEEP 6144:pVjuHfNwVk2IcwksKrkL6xIdjZwL5/Q5Tmcql3JeLBo6IXtOqoQ09OSM:p1WFj22k86x+U/Q5TmcqveL+6NaHS
- TLSH
  T151B49D15F3E946A8E07AC1348A538643EB75B4820F65FAEF03E052752F37BE45A7A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 4edc26548b5d22ff932257ff59e468b9119d6f4c691fa4e1683d94b25d5b46ba
- MD5 3cb1a278552d7a3aa46e2beeafef93cd
- SHA1 899ac3687d79a752ef23e7e8629bbea0f8d7eff7
- SHA512 cf44782513c28e616683bf010c33f14399ab9e5835cedaed3712c670c0db5eb97a9131fe5ea7d23241028e27cc8b39831ebac955b9a8085790e632637a72c007
- SSDEEP 49152:RLe6/cUFf6P7ql0XwFExC3QOvRF5ZCZupBkPm6VsYywolfcIaqp03zTUmxuPblQ4:RUUMWNMCpdlfC80n+dYYGuOkq1+Lnx
- TLSH
  T1AB867C03F69641D9C05DE2788757A223FB34B8450724B2DF2AA457152F6AFE0BB3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/elevate.exe
- Size 32KB
- SHA256 bb01cf9f5e651ab16804d37a7269db932664989c34d26ccd204038995aa8fad3
- MD5 257df4ec26179df3c0b800716ab0fc50
- SHA1 c07df0bb9d0d87472f41847b2a8c59e5f62ed6f1
- SHA512 b00227508248bb356c8ebea16d5509b70edb2d0efd259537bde1360c49ca5cd7d1cf54d4bef608a7f856d7c279a8eec790c0c5ef14ef09269284e495f2f87c23
- SSDEEP 384:Qg+rYCv9UmB8x5IMsKTm94a8Jrzsmec+EFR/G2JKlMmAGnwHjr4ruQ7wSiWWU86:ArYCvW697Jc+j2J+yGwHX6uCk6
- TLSH
  T16CE24C89DA9B41F0F96F25F0186BBBBF0437BA12D434CE29EB485829F932F425605309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 6be6d3b872a55209e842aae41584d409db3596c72911356fddffc405c3754887
- MD5 9bc747deb179c99a3bbb5eff99ec15b9
- SHA1 22e8a4ce4ecc39276f2f4a62f4242eb390dfc8f6
- SHA512 c136a564ba3e900521e4caceb6ded4889a0b3603ff65b5aac611dd78b246baea3652c5bd1396636ac338695547803cc2deb7ce08d2b42f9be753939bbc5fc8c4
- SSDEEP 49152:YixHPC/InMj5kgotyssEw/Ga8irpnhQMjQbw9mhBljAAV+afo81gP8XCEQdtXDxP:LxHPdNPnyFslWgr+DXuEJ
- TLSH
  T17A463803F28681E9C06DE579875FA623F631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vulkan-1.dll
- Size 932KB
- SHA256 1c01a7dc24b5b6b9cb88026adbdf5e99551e091fbdd9d552e6d472d2692a6aa5
- MD5 183fbc4aaa5d5c59b444698d56ff4d58
- SHA1 cbe4b01593e726f39f6ccf9c7c3a408fea82ae41
- SHA512 a4b2daa3bbb758f28ab2f9b1a8c6d5b6532f4aea79fb3e18b5e121e1608ebd90dc739c84ab996d11c1e780c4cc7b5d91c3b9166bffb35cd995b278a29d79f407
- SSDEEP 24576:9g7xfpW1F35jjly/ux7te3MDSozK6Z5WzcxDYsHkDE6g3P0zAk76oOHbRK:iFCh5jjU36SozK6Z5WzcxDYsHkDE6g3c
- TLSH
  T1BC157E22DA948A69D676C074D8D18A038AB074811712B9CF07B81714BF6FFF47B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $R0/Uninstall Basecamp.exe
- Size 516KB
- SHA256 ce4730c67e7f4d6f1a69e4b006b28826ffc84784c5bd0bc6b74c37b0a19e75c6
- MD5 ef57ced3ae37c2c0bf83b38fa1e2c9f5
- SHA1 d5bba90c1d481e5deb9c691ecd7904ee3a230de8
- SHA512 a83b8c9295931ad9bbb14a03149065724528ba5f553bd2456995df9b66a4ed6c74047b1501d78148d12a60fb5bf59a3da118a54d7d9e4aebad6cb2fcfb14a9fa
- SSDEEP 6144:/shdioo01pSK6XfQooGiEzi/JBugT2t0EyL+4fal:/shJw3XIooFEzi/HLRK4yl
- TLSH
  T16DB4C422E1C7291EE2910D7629430287FB8F9D32862B45619BD6BF56CC7E4933DF3216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32