84114420fc4a73b25f6d70d44893bf7a5d5ac7d7418dcca1e5574681cee85c36

Sharing

Copy URL Twitter E-mail

General

Target
1.4v.exe
Size 94.1MB
Sample260907-avxajsam8y
SHA256 84114420fc4a73b25f6d70d44893bf7a5d5ac7d7418dcca1e5574681cee85c36
MD5 1819f2999b4833a2654904aadd5e993e
SHA1 a3590ab80d12976a4dcfa9ad67582f6a63a6bf06
SHA512 5fd8559cf8291e0094fc9a929d6c77e5968537e07f5d8cf25576860a721e4771705a6d0994dabca59f73cfcc64bf765162bb331acb003096c348a9344852d232
SSDEEP 1572864:t60gG3Bw1D+neDSSm3TfGkPrFvofPlkrguoBuCv5KOoPkM8Dy5BhyZgF9Th2jw:t60gN+neSSoGaIPC0uonv4wMJhrFNAE
TLSH
T1E62833912FF00D7FF09EA875B18853E26C9F7CB228C54C869A5C54A6B0744D65AFA03F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  1.4v.exe
- Size 94.1MB
- SHA256 84114420fc4a73b25f6d70d44893bf7a5d5ac7d7418dcca1e5574681cee85c36
- MD5 1819f2999b4833a2654904aadd5e993e
- SHA1 a3590ab80d12976a4dcfa9ad67582f6a63a6bf06
- SHA512 5fd8559cf8291e0094fc9a929d6c77e5968537e07f5d8cf25576860a721e4771705a6d0994dabca59f73cfcc64bf765162bb331acb003096c348a9344852d232
- SSDEEP 1572864:t60gG3Bw1D+neDSSm3TfGkPrFvofPlkrguoBuCv5KOoPkM8Dy5BhyZgF9Th2jw:t60gN+neSSoGaIPC0uonv4wMJhrFNAE
- TLSH
  T1E62833912FF00D7FF09EA875B18853E26C9F7CB228C54C869A5C54A6B0744D65AFA03F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare services registry key.
  defense_evasion
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app-64.7z
- Size 93.3MB
- SHA256 645b4959e391e8d137af19801b4bc750da77131de0ddbac2adfb5231cc9befbe
- MD5 f9a7e62086c217f42c29591ae479e735
- SHA1 28ea5d8156be09b933bd598951bf690aa829223b
- SHA512 ce25529235875f8d779feb97747bdfb8f1b66ed353c3136db9d9121843a39ca55d95167ec1fa52466ee7d3f86114a3a84f735cc6c1b6f0bbd2b9a271dfbe0ff2
- SSDEEP 1572864:K0gG3Bw1D+neDSSm3TfGkPrFvofPlkrguoBuCv5KOoPkM8Dy5BhyZgF9Th2h:K0gN+neSSoGaIPC0uonv4wMJhrFNAh
- TLSH
  T1412833511EF0124F821E687970C983C29DCD2C9B3D965CC2916295F3F6B48E6AF8B16B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/archiver/package.json
- Size 1KB
- SHA256 82363c2217ea96a80ae9c3d796a5da41589ba329ef0947af1b6e3204609a8a8d
- MD5 6326b02855f14b461bb24bf27c1bd556
- SHA1 1147237171413b7247090d44ece2e5d32c0582ed
- SHA512 57608901b8739d00dda81d26d801f73fd357f4b1f748436b33909ef0639e85928dfe139e589ca86b92c6c9ec0e1d04b533ef8ad599e8e70d90e27b054df59d85
- TLSH
  T161115B25DC249FA32BD945D4987D0292B39148D38E44BC1C77B6C61CCF1D8AB31BC6AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/LICENSE
- Size 1KB
- SHA256 09856b52897c91ab67e7456ef43067019f31dfd3b87fda72e655736b1ebdee55
- MD5 daaa6378e66cac5c1de3eabc51c6020f
- SHA1 af2953c8dc440c83d917e16ca36146363a283af0
- SHA512 ab76e13a535d397ddd8e33caf39fcc9cbdc8b63cb8c5de70e4df328d4a85d19978b1da0a52bd795a2eb77a897ac2ede8aa2e65d17bf286e1eccfcd8ccbffcd4d
- TLSH
  T1FD11B91E73510B72189A13A055786CD9F23B715F7A5F2E84246DF341233B06CC1FB840
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/common.gypi
- Size 1KB
- SHA256 e71a565cd7733e05efc3a2792b54e260126f03f490325aa2a201202acbbdb315
- MD5 bc44eafb20590feef28f6382e0db7ea7
- SHA1 db26781b95d0b3e5d97371b8be96d842f3e7c365
- SHA512 c8bb9777d8ba552668cda8e21bd5b7dfd57077b1d944b3ff2ea36502d2f2883374824f0e01ac57f9ceb98c9dcdbec3cd8a6c6d0cb8c79bc627c0d20cd34f8f26
- TLSH
  T17B3187B404BB098FD0AB663F905E6448A52985A30D3C3F74B15D048D0FDD48E83BA1B8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/defines.gypi
- Size 1KB
- SHA256 029426d3d6528d56ea75682a67a49e48747ccb7439faa75107601d4e2cafabc3
- MD5 df6aad70662c3051d98ee622adcd9c53
- SHA1 24c8f38b88987b4a41aa325ce5d08fee3be7b3e7
- SHA512 58e98874dd6c16d5899558a6f08218c07c52a430b12c8aec7691fe0ee504316f53eb49e6e38cecbe7d32baa28e0c5b74fb12dc112f55b2b1e115c8cfdda85b51
- TLSH
  T1532144B51B575A0D36BA141BA43C850A7B84E2AB0F3730407050AA684FFD8FE08364BF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/patches/1208.patch
- Size 597B
- SHA256 5d1f22d69fee3551b70a7b7b9b14be43fcfd04dbc8683233667abfa75905011a
- MD5 c26f21402ea045fee5214a2af12b8d25
- SHA1 9adc0b47f388eaeb40685151ed8e67da4d3382ef
- SHA512 3f149123d9000f1e3e285125ace919a25eeb776343c4336671a40b752aec513099976e3b0342faaf306997139d445050e456554dbe05a70fe3e775f57ca97750
- TLSH
  T198F0F68255F66B9371EDD170811B3DC643DA222CAAF3088E364C5BEF1F4D28D8759C96
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3.gyp
- Size 2KB
- SHA256 a009b8f80cf0a944eacaf71a84e590504f353fbd8f8b341138d0c3094e372d18
- MD5 ec4186a11866324c718f05aa7070de29
- SHA1 78f251a963af25d039dcd82c38deb31723b04a88
- SHA512 659279f346bdcea623d26c0619b088852137dd598677f3abf6798fa086292fac6d78b90071d116133162ffb5bf3c275220468727a8e2c8a3ed0ca3aad7dc037f
- TLSH
  T14F5142A8197F1309A5CA6A7FF95D82C20428A117CEBA3D35B88E44492FED1CC1233F74
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3/sqlite3.c
- Size 9.1MB
- SHA256 4400debe164efbc652cf868a951f6eb721e25f794466a8fc41cd854646883da8
- MD5 ab232dd11ac549681e641927f4b72e3c
- SHA1 43879b8d97e8ca675ff71defbda826c6f296fdea
- SHA512 63e2ebf40ca90bede5d4c9fb09e1fa659a6869df5f0a32201c8d8c48676e4af11fef98c484a285bbb3c3d99fd61a0f5a02d06cb0d09f1126d1b0dabfca58e5b0
- SSDEEP 98304:MoX8z2MEM6mL7dAtP6bR3P5wkCld01NkeVGgbOLpm8IbSBdolNNYqkTcytdtZTj8:d8tKtP67F0dg
- TLSH
  T14DA61AF53BC30E2760D38175A76F32D0A219C02F67B4D0947C5CA1382F58AA5967ABF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3/sqlite3.h
- Size 673KB
- SHA256 16d6e2f265fb13ece42329da39a865d4c540045b444d16b4bf9f7e1a7e39408f
- MD5 e31c9d55c55fefdca8d09613e9c0bdb6
- SHA1 e6d04cd620491fb16d32f7598bd1ecf28f0a4cc5
- SHA512 0eff9f3abd3822c9ebb0a4b3b6458a91c8a6f29197f623e0fc89c6f07bb525516b9f2725af531d8a856a198597519e4b17352a3de78be54676efbfd9d964997a
- SSDEEP 6144:EYuVMvmZCuA9CK+rvym0kVs3uvYJ1KKzR0XXUDBlZVurxqc+uqwdzBzfJ7LdKwt1:HA2InDyLJ4YnKKzQkjZVQb+6FBwi
- TLSH
  T13CE4A5B737032B3A20D341C1D16F53E49729E0ADAB715064BC5CC1682B25DA5A37BAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3/sqlite3ext.h
- Size 38KB
- SHA256 ac9645e5c9ff0cf176efdd6e75cb5e98f46295d38e02db5c4d208826a39ab4be
- MD5 162f3e108e18fc2306d19ca7ea4173da
- SHA1 8aa6409d84caab65654fddd8f6b012927b7619a5
- SHA512 b6a838e9802c5e694975803454f5ec94410d79d1228722e981379a3d3e78d4ca85984325554ff1d7f497bdaf887c5fedde035479b3b576c4c0d9a8f38fa8245d
- SSDEEP 384:Tuz4G/SLqcMgCTmTgVYmLEjMhN0/kvINuYY04vFJzIAx:TC4NH7/T4YmeM7nIYYYAO
- TLSH
  T1130365D36B93105E74FBC542C19B20D14016EA33FEB3A7E4FE1DA8280F52665A0B65ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/deps/test_extension.c
- Size 587B
- SHA256 948af88dbf356835f5496c1a3d047fdbcc58f3717aa9bc94d0943d7de2b7cf5b
- MD5 e5338de97cb9fffe3bafc7534c249be8
- SHA1 9430bda15ed8d152f41f1ee83c096da50c80d00a
- SHA512 f336c5bf5f2f93e13864e0f7b71034009592ebe3504f6bc4822983ba304cf71d1040ebb484e155c7b03c43f999908e8fbc25182681ef69edcb5169a94975c3df
- TLSH
  T119F0ACF2270F24E934DA8421C4BF90DDA220D11CEF30A459E84601C00E741AD003BE75
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/better-sqlite3/package.json
- Size 945B
- SHA256 10984551c55a7ab676be9986718d0edc5420319601f3ef36f62565638e5ad6d6
- MD5 6e3d5ede5f4d4c955bf6c1f206376651
- SHA1 50c5042f4cc2d0ba923c0b08ca431442feb8c3b0
- SHA512 97fb6ba05d8f0ec31f39e791f7f3e32ce3fb557e7f73b3e3916a9a3eb030fa431ba575ceef2c21ab35e2037c3e74319ef3db976ffe8811b746c52430621b5115
- TLSH
  T152113AA0CE258DB32AC569D5ACB91182B22048078CA4FC4C3387466D5F4E4BF21BD67E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32