c3845b004e2accb7a5768118380f52ba0a3173031b72434496b43e7317720829

Sharing

Copy URL Twitter E-mail

General

Target
IROK_Setup_v2.6.0.1_online.exe
Size 122.6MB
Sample260907-ec7qsaee87
SHA256 c3845b004e2accb7a5768118380f52ba0a3173031b72434496b43e7317720829
MD5 f3d7209da696ff7654c35458d32e61c2
SHA1 8bfa5374b9f1d7b5367f1be01278d297cebe3327
SHA512 fab965f14426c20b875c968590e1cd5bfaf313664a836809c67a570351ed34942ee563d7706cb407a9d0b580948a0d3d9c5d77d4304a645a15a49569cd97ae68
SSDEEP 1572864:q0o/6INvCt/TFW0Fwtk+wfKmifxnub6991A1hXsELWckqDhcJzYOuhl5j82OEA2C:q0o/nKLJamUS1hXtxhc1YjhlF82VAXQ8
TLSH
T1B858334C72E14339FBE33473DD90C601BAA15F7858156CB96EE3F11EE67A2D406AB40A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IROK_Setup_v2.6.0.1_online.exe
- Size 122.6MB
- SHA256 c3845b004e2accb7a5768118380f52ba0a3173031b72434496b43e7317720829
- MD5 f3d7209da696ff7654c35458d32e61c2
- SHA1 8bfa5374b9f1d7b5367f1be01278d297cebe3327
- SHA512 fab965f14426c20b875c968590e1cd5bfaf313664a836809c67a570351ed34942ee563d7706cb407a9d0b580948a0d3d9c5d77d4304a645a15a49569cd97ae68
- SSDEEP 1572864:q0o/6INvCt/TFW0Fwtk+wfKmifxnub6991A1hXsELWckqDhcJzYOuhl5j82OEA2C:q0o/nKLJamUS1hXtxhc1YjhlF82VAXQ8
- TLSH
  T1B858334C72E14339FBE33473DD90C601BAA15F7858156CB96EE3F11EE67A2D406AB40A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.command.1.tlog
- Size 2KB
- SHA256 382b064c89a113295fe30dadd140607be7c36252abcd90091d0d05068a3b184f
- MD5 818b1963d6f98f241986d156f4642b98
- SHA1 577e552e89a6e90f9b83873889ee6d3875c7dacc
- SHA512 297b68fba9d983a16c50fe60b2c5ff30abe72b3a2815d51b45f3e12aca908d4f083a3d550bff7a1217fb71eda05d31b2acdd4e845e4acb60b54dd9aed0387b8d
- TLSH
  T1D9418E2434FD711E9322B5E64FDEC17AC326B6ED866B5B3F14A0568F4351C466B03A70
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.read.1.tlog
- Size 4KB
- SHA256 e8028222504daee50db9a69b1614a802347ac4ab6262958ae19617aa374092ec
- MD5 d70f3250bf8468a877a8044bab4627b2
- SHA1 97ee6545120d8f3f6bd367b275ca59608356d214
- SHA512 a22dbd8e7c07456cea7287b8fea249bca06f297d9b741ccd4cda07091cfcbcc388107bf6907ada2e7755440aed7212671c9a9b6850a23c43a6db4b9c4e095dc3
- SSDEEP 96:upVpIJnt/6GOIYuG+g4lpIypz7RrHVkGrPIutV7rD:VJAW5w+D
- TLSH
  T105A18F2930FA324A5716F1C18BCEA16BD317F6AADA2F173F44D4434703919076A03EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.secondary.1.tlog
- Size 651B
- SHA256 51e9e0c568195b905c680b8269d9576dfc730484af48c22d6d933379ed912dde
- MD5 1edafd4107acf8409417b2bba0364168
- SHA1 fc5f334dac0be94b81fd323e75a5861228acc0cf
- SHA512 e88d81420955940b79fbc0a7bd684840662d6e83732755886c73dc3327584d293b7e0d12291145f18ba20e1e0e72ccc6e2a45b4c521f33f1e2d9b32005fdacd7
- TLSH
  T193F09EF579380F329B497007E4634D08F6B6765CD0AD1818D24C4BF30DF204D8191DEA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.write.1.tlog
- Size 898B
- SHA256 7809f9c6b6d77eafd8e80ced4d68edccb9a3137de545fc08eb2d31425d5ca457
- MD5 a28f5cf8f6d10d64153abae4d0a4f597
- SHA1 7ed74144a3cd1d5a203ed07dcf56ff8567b745ff
- SHA512 cecbf1e6de3934576d7e7e222d7d1994a57d59561d2a3073b323c314d701553fdcb55995dae5887318a01bb027c6201e6afba07d333759139db2f2b02303c81d
- TLSH
  T15311A52534FDB40A6322F9E24FDEC1A9D722E1EE86876B7F1465670B9710D450B438B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/vcpkg.applocal.log
- Size 5B
- SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
- MD5 3bab25a3e651a9e4a00473d2257b99f9
- SHA1 1419458f2696be8daeade77ddad380cd0c871fdb
- SHA512 ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral6
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/bufferutil.vcxproj
- Size 11KB
- SHA256 1812c84a304afc590bae6fb6e7717149d8f1e1a4d72975de302a392ff357642e
- MD5 b9c232d6bef0786e02e895f307f97a27
- SHA1 08f71cfb105730b1e159f22d0bdbca3432cb05e8
- SHA512 962aa3a3a54e5915434b5bc325b3e1ae3dc83b0c75be6de00fbf8b096567e157d442f135056dfa59135432b567d5cbb72422b2d25e9a12f0fd313474e036b77d
- SSDEEP 96:fQgbfMEaLctZvfzldGWqE4wAlzvN1wZwHUqE47ApqE4YAlzvN1wZwHUqE47xB:4g9zPGF7F14wH/pAAzF14wH/Rj
- TLSH
  T1C3327546F4B85BBB918B292785E00D4E0DB2D2976D5904A8F64DD6DD3F6B408A223F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral7
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/build/bufferutil.vcxproj.filters
- Size 2KB
- SHA256 513e227312a73c7ba6800b26d24001032baa7a2c18c7cfc321e13573b433d432
- MD5 304dcd995eeaf374f81b7601ad1e4e0d
- SHA1 13226aac5be15cdfec09cb383829be4554feaa22
- SHA512 f0bc0ed8847728410175275a9847b38dea16dbb2c04411b989b2e7a138600132022e996945d05d1ef1f9828a37cd9700ac600f496f92efed1db8a556d9ef4ab0
- TLSH
  T154413630D9FD0AD4A2270C27F580CE02BFAAB1F361D9111475DF85975F66705A2ABB2C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral8
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/fallback.js
- Size 899B
- SHA256 f4a65d1a98db49439616119fba09be0d9a4217af57b21282ab7b91c8b5a082b9
- MD5 e7225196819df0032629fa873f3a6a47
- SHA1 2e089facf7a2df11e50f693565c810b9de0e4095
- SHA512 56b89a7aff78fe2a231f3622804461e41ad67ebb87ef2eba4dc75cf0b1cfec769318fbabf7f2bd2c701b7beae3856a38d226905d16be7353199d215dd5758191
- TLSH
  T166118C6F6F14126D0407F7D581859E8F42344724F3EBE988853E7D210DDDA614EB2CD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/index.js
- Size 136B
- SHA256 70846a43c2bd3b1077461563194e4d2407b18e7d767d6fd8785ea9b7d6ddd044
- MD5 4ce2ef7ae60266e7ee9f8a4078117193
- SHA1 a11314facf16ceba23abf556cfd3a13264a3e390
- SHA512 840f27524a2b576ba11631beb55940473b74f540dcc5fcad058b47e5c0a137fea946555041224fb6ef1c1fbf2704d01ffc6a046c7352dca45e7b55d2acc00df9
- TLSH
  T1CCC02BEB0CFDBA8312D5C143E160861360CEC090084C4401C75807C303C0C880B93DA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/package.json
- Size 563B
- SHA256 a5e350105096599a36a19cd884cc71d0de2b5faed3d8686cfca94c28ee9cf5e6
- MD5 e051368c5843bdd59121c9c50f000383
- SHA1 29b7713c5dc33bd545e66121f311f7725556556a
- SHA512 2dd21e3c90e4d54b4a3f204ffce4eb83ed57cbe1ccd60cb2eeae38a76346523e012ddc493dbf804efcf761273d9e62d252661c7e46abcc4744b5b99e71bbca83
- TLSH
  T19EF046A2CC6089B35FDD2A95A8790446B3610C638988FC1C2393473C464F4A7A0BD59D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/darwin-x64+arm64/bufferutil.node
- Size 65KB
- SHA256 ec4a2f3ee4b260eec19354e364ecd6aaf927009983523ec92a4a76e1e67097e6
- MD5 8db7977c35f33a4d668271967d719f52
- SHA1 a825bf8ec7c1d4257cf9e2f70b6c808999a7d3bb
- SHA512 a4f99c52fffbf95a2795f43804127f21ac8ef2b6082b9f1d14f6002944c799ea1dadacb790283cd56a66e07f14435c6a2efc1d79db14664f27952005cbe93972
- SSDEEP 96:jWtkNGs/Q4Yp7IGDrt31thQaHMlXw6kuPIEbp6c8GEp45YG9ZK1TAo:CkrKZ9bxMlX/kuT5u1TN
- TLSH
  T1CB63E71BBFDC2992C00CD1B4C59B4B47782AF6734E59527F2B51C1681F893AFA8A160B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/linux-x64/bufferutil.node
- Size 14KB
- SHA256 2efb202a47d8baa6887b8df67729469eae0017d4f893885c42402eee74bd60b2
- MD5 c31aea530d8964997f6cd2c1c4a515f6
- SHA1 b7bd0b68f2d03df8566f7eed022e20ace692032c
- SHA512 9c8fd5fc99a6ff5c31775b79097919957c45734e179eb2049e282da559a873369911c2be38c9835da3f11b2a149287733184621c28fdc262e7551be28d3539e1
- SSDEEP 192:Ruc/8GZ0zwUBxpB5RJhjP9AHs9Er9ofeK2Qi+AB:XB0z/BxpB5RJhTYiEriGKvA
- TLSH
  T11662C74BE761C93ED46CD330CA5B4B24A2B2BC98667003172F44B6361DA362456AB99B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-ia32/bufferutil.node
- Size 124KB
- SHA256 4a175aaff948f99767fb490598cd01ca43223e30a18bd27a66ce8db88fe18247
- MD5 dae24f4927383a82f614d94f72df48fb
- SHA1 574d191edf1272fff95f0221dfee5495fabcd8f7
- SHA512 20fc56e0fa7a965b926d9cbda343000e136610087bf24322f0238fd96ec10f15149139d1a2fdffbbf532fa67b0d7cba1acfe514f4128b6115116c1c36d75af8e
- SSDEEP 3072:7MGQ84L0QpCTi32vHKIXGzZYOGk5mAlwC2O+VPiVe5T:7/QvdWisH7GzePk5PhlM5
- TLSH
  T109C37C41B5D0C472D0BD08390924CBB59B7EB974DF609DDF63981ABA9E302C0DE36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-x64/bufferutil.node
- Size 150KB
- SHA256 4a6ebefbb829dad1496b3104957d56d4282a7b25240d9f84f11d9c718a01d8d3
- MD5 ca34f95359f80f5d4cdfe79ec8c962c9
- SHA1 cb8186ca6bb29a98029640bf87cbc44ae1de9ddf
- SHA512 76257123f913e38278e5fd458d3f7d561318e681340f35f9d541c575c246465aff3fc08417fd1fa6a5c8d6fdc616319aaa67d3f944aadd1561be79dd035f752b
- SSDEEP 3072:UoSb+qWce7L+25Y55Wk1bVrZvmwV50W3e:TWApX5I0Obmm
- TLSH
  T108E35B5773E500BBE1B7863989934A46E772781107209BEF03A4477A2F237D19E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  browser/resources/app.asar.unpacked/node_modules/bufferutil/src/bufferutil.c
- Size 3KB
- SHA256 f51915636a6551cd180a7f86611fded942fdf2f594f7ba295dc7564faa74188d
- MD5 b9d8bebcc2427640e3d782905c97a647
- SHA1 0a6a588f0ca76d706749429c3434795700220869
- SHA512 1e397e97d56b40186939a8ab93f0befdd64c973db20883566abf8456122395ff5522322f0054704d1d05d0bff879f2c0eaca7bc8367d5c5c5b1f067e66d08240
- TLSH
  T172719C8D5C17F803091655B703D6B7519CA44B799BDAC64082DB1188BE70EEFD3AFA34
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/LICENSE
- Size 1KB
- SHA256 ebf774f60dd27325cfd62c233917dfcc8551f808f69ca8656be7d1eaf13c44f2
- MD5 809468040cc172e205075206079f7263
- SHA1 ab4ba763dd67ea57a2331f9c1365742a0d3dc94e
- SHA512 ed71eadd544a99989ec94ecf119af763d705a24fdfda6eb3804b5713b3da47400a2a96042fbde4906b1635875112e1f1ed493040cf779c157a5688bbd2ebfd00
- TLSH
  T14821B66D3290876118D64394797AB8CDE21F718E7EEF52C818BCE645133649DE5FB804
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/fallback.js
- Size 1KB
- SHA256 74ad313e48d1008cf20e4ad691f883319be8baaff4442d86796819fb4d7969cd
- MD5 8ef7300c1c722fa879a08ad91aa6b5ba
- SHA1 b433b379a86afd5097c30b13a87e53fdb520e321
- SHA512 efb74434a74eb69d290f510128cef51bf0827ebef4f1269e45785ff8411ddb86ab780596c36890c91ee5c7bfc1801b29448c9be34039aa13946836052684d88e
- TLSH
  T11E3105C9949335714BA3E569CED5980A221888E731586A08FC8D3E80DFF4270D663ECF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/index.js
- Size 136B
- SHA256 70846a43c2bd3b1077461563194e4d2407b18e7d767d6fd8785ea9b7d6ddd044
- MD5 4ce2ef7ae60266e7ee9f8a4078117193
- SHA1 a11314facf16ceba23abf556cfd3a13264a3e390
- SHA512 840f27524a2b576ba11631beb55940473b74f540dcc5fcad058b47e5c0a137fea946555041224fb6ef1c1fbf2704d01ffc6a046c7352dca45e7b55d2acc00df9
- TLSH
  T1CCC02BEB0CFDBA8312D5C143E160861360CEC090084C4401C75807C303C0C880B93DA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/package.json
- Size 591B
- SHA256 9dc079142205924338c1ccfa3bbeddfe5745a191f96f3bc6f1df4a423001578a
- MD5 e4525b00b455ecee572b713044124e71
- SHA1 ac59a57551231101e24f80285567a3050331b109
- SHA512 9c317b3eada7237a7d98ebdc60da1307bd111743ffaf57f5be60628fe4e2690f082cc497d4fc600bbdde88fee9b020375c632cb3bda18049decac5bd91331bcb
- TLSH
  T15BF04670CC6496634FD91AE4A8B98123B3616C53884CFC1C27D3463D929EDB710BE46C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/darwin-x64+arm64/node.napi.node
- Size 113KB
- SHA256 0ed3fef7154849143b7b064d33e32b339b86590c0f5719cee8b46b150e83a3e5
- MD5 6591ca6daa7a49ac824295fd24b43e6a
- SHA1 8dc4009c4f701f2ae2e2b4dbd7176ad3faabccfa
- SHA512 43845886baf2cf7ddfc9c5a78274aac4c9fcc9fb530662424ed456c9694a88d85c59b865b004178e6ed05d63049f8992d4830661716a3af5e720dcc684da7028
- SSDEEP 96:/+XyqpoW/SprdsA05lZmNOh6Kv7kIUarv+BlhGRUDZYg9UrP:AKLdAoNOhv7k9wv4R2rP
- TLSH
  T184B38502AF4C9953C45DD13D88DA0B42A53FF9A60F4A1B272A80F1AC2EE53D6395691F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/linux-x64/node.napi.node
- Size 6KB
- SHA256 08c0737834fb5c2ca38efe64e274c1072d7edd18415275f9e0573df5bcdd0e27
- MD5 2f99a3efb47cfbbc6afe89ff5eb5f305
- SHA1 ce50fdc0bf7d1893dba7a7422cac99f151d758ba
- SHA512 2bca6d60aa7fb9a98136b4beedbda0e0ed55769da43afabc4fe4e19f1b3325a62284383211f9883d9e01cd8a79394b880ea808a4d03ea65e48b71265b88e626f
- SSDEEP 96:RsLMBWBmvYSnOe7WQCW8k62rhTRNE+iVeZIE:Rf8CYSnONQ4p2Hli
- TLSH
  T151D1645FF660C63FC85D473848DF427077B0AC5A664203336604B9793C166F82B566EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/win32-ia32/node.napi.node
- Size 119KB
- SHA256 0808ab542c43b9df85b668a02f0705529b7bb9ac79e26b0776682657c6005352
- MD5 5393f4627178086c3fc6002a46ed7282
- SHA1 c1337f1d3d21ea57ea3029ba45989ebc074920bd
- SHA512 7492b616080ad51f429036a31d2686e179f96f8b45f57bb2fc9b184e77a5c99b00ea66ffca03aa5a7f0352d4b06976b782c14ca17a2f23553923b506340f63e3
- SSDEEP 3072:3h647Utr5SJnr16sgKNhaqKpgn/MbFDIMHk:RCVCrwKNhhWgwHk
- TLSH
  T1A4C36B01B5D0C032D4BE19380530CB7A9B7FB970DE609D9BA7941ABA5F702C1DE25E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/win32-x64/node.napi.node
- Size 147KB
- SHA256 48b7275f47cd44a05d349eb4fdb6cfc451ccbf609a4a56fa34452bcf231c1208
- MD5 5cb6b3762df753d84e4ffd4afe1a7e1c
- SHA1 ae2b1c4652aec7315607fc413a4c258f11b69544
- SHA512 5723c10ea9c26524f7866b9c749d9887b10c1514bf0cc893ba2a6e9c5d9690015cbcbe024653956af3fb842de3290b4c6c4beb051b67480bdae543d8fd3981cc
- SSDEEP 3072:Tg4thDJpRhZoZKuaIXWl3zvcIS2zeqsVHCx1s8d:57DTRhmZHLijvz1x+8
- TLSH
  T1E7E36C1BB3E400BBE5B78275C8670A46E772781207609B5F03A4477A2F277919E3FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  browser/resources/app.asar.unpacked/node_modules/utf-8-validate/src/validation.c
- Size 2KB
- SHA256 d8fa43aea13c622040d1cb2f6d05af0f1013bc9227c133ec81233d1228d77f5c
- MD5 10dd70612509ae5b69e61686ff94d5d2
- SHA1 f1e9d0c92517a64bbf61b103f07e4428409baa70
- SHA512 d597d4a5a68c2059c8fff0f1384301918e6fbc54d8323c74b3f433062a5c8c8cfd5bee381451fe2825e4d13247e6895f567752d4c06b6a5c421a2efb870ca10e
- TLSH
  T1A751AE88849778910653E43A8BD5A50D2D088CB727588B047D8D3EC0EFF46F5E967B9B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25
- Target
  browser/resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  browser/snapshot_blob.bin
- Size 309KB
- SHA256 31b6067f7e43c00946343d88f5f9167151543292211874f1edf8ba9b6b19d9eb
- MD5 bdf2e2cab5037adc41774fa1caba8ea1
- SHA1 b1669825b4ec8661d2f65eaf70eb2abef1ff0e10
- SHA512 5138e55645dda2918ef73638547fd8851b7bd3211c5fd5ac4f8331c5cf48425af58d4fb8aee223b12606865b37ade17bf8252d2dc079f3a5c432af5ab913d8fc
- SSDEEP 3072:M+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:MefPciePmMXh1aOCsy3hpFRlzVw
- TLSH
  T17764FB44B660CB16D75526B48CE8DB993A78F2CD6F06AA0F318D43FD3976B340A053AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  browser/v8_context_snapshot.bin
- Size 671KB
- SHA256 96539ed02416163441b9847175f2ec1f5708e321e1fad25b03ff7b47b7aa991e
- MD5 04d61b8d7f3e6a3a81df5bdf418904f1
- SHA1 353ec04045f72d7712e013bc0e1e782e24275015
- SHA512 608021d64470fdc4cfd20e55b92dbf2e901b1d239395ca7754df1260cb7884f45f175951a81ed5cfc6165c1cd91997725a2ca060b7cf701102bad33c1cf34054
- SSDEEP 6144:iPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:iPY5nnbe3WZBr/iXo73nVE+2l
- TLSH
  T1C4E493A5B311DB02C7C95DB89DE5CB563E79F08AAF0BA51B314803FE6036B750A0536E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  browser/vk_swiftshader.dll
- Size 5.3MB
- SHA256 22b81a04d2d7ff13c86317148080a7feb1d967ebdf10ba8d2446dad6db849913
- MD5 251f0372d263f52c9593fb39d4ef621d
- SHA1 e01a91d211e442dc9cc43e74a8bae9708a82a971
- SHA512 c32afda44ee135a1be318e07dd965deeb440c9c56515d61343b11cef09254508ee8d67c3fe0d08201eece9575671ac0fd69ab1d280de94f2ee949e6bbb62ed34
- SSDEEP 49152:KaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+8:p62naMskwtEMaQPJnyVh
- TLSH
  T145463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  browser/vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH
  T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30
- Target
  browser/vulkan-1.dll
- Size 874KB
- SHA256 08e6cc4aa3e1154b1b236a0ad0837b35ad07daea2febc4e567e59c02b27d8646
- MD5 4ecf3e42731c897fa4f0f74468c1874a
- SHA1 4fb19be1e78b4f8206befd8ee05160a08436e392
- SHA512 42d65eedc61236bfd7738ac57dd9489903f22dc7121cf74c03dfd4055155db783b4b69ee300da68a4c96e222a8793c753630c8144d7c6586207808c91d0fad86
- SSDEEP 24576:f4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKC:f4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
- TLSH
  T1CA157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  uninstall.exe.nsis
- Size 4KB
- SHA256 71177759a9bcd99282df30f8fdc6df2889c72d72b701acd20632172fb53fd42e
- MD5 d447efcedce0cc7c1315aa06a177bb3c
- SHA1 0d213feb708cf3814d19dcddbf33c5734a848819
- SHA512 45eef769513bb18e272bed361a24a8369af5758cc92e1dcf74362b3784a8c4d11a8c73fbabad2eec4d2c15746cb37ce61fc1b7263f31f820ebc68c43472b8b4f
- SSDEEP 96:6M67ecdgEq17wIrbF2BwAyViJx3R+9pd0wfhMViBNUosoroQN2LGO:l67eIgEqTrbF2wRLD5Pv8tGO
- TLSH
  T189919F02ABA11B840932F0C1BC46DC13CF5A013BADB228BEC17432FEED43211AA447D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32