e0865d6b415d2784888dd54dd8176fc9bc0b19b58eca49aed50b9e67b63d9234

Sharing

Copy URL Twitter E-mail

General

Target
QuestVault-0.9.26-x64-win.rar
Size 92.1MB
Sample260908-q34bts1vas
SHA256 e0865d6b415d2784888dd54dd8176fc9bc0b19b58eca49aed50b9e67b63d9234
MD5 0ed213268ee1f5b779b2290eca546bfd
SHA1 85b5e9d540b365c9c0af5aefbd05dc3011aaa831
SHA512 4a2bcd8a1f6617753294f3d22e7dd9c0e1273f1b5aff363eecbb6c76c0e72bf59f44fe48384fcc1123b2282d864beaa78b47ebcd646948964328b1fcc3ab46dd
SSDEEP 1572864:Bl9KI60p02LFolCUTJKuxi4pAVHtzCHlhfYEUL4xE3yh/yvIYTvzgWM4ffl7IvNZ:B7KIX0kBUvi44Nzulhf3ULKErFTMWMOU
TLSH
T13028336DB85CDA6DDC430231786EFBA21DA7F35F8C2129185BD3FA255A09B638DC7102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  QuestVault-0.9.26-x64-win/LICENSES.chromium.html
- Size 14.5MB
- SHA256 c54df6af4da6dbe8199869b48d1a7c8c457bd96441d944377b83e173af2bb2f7
- MD5 61d40de61cb10894d29d83cb9b1b9cc4
- SHA1 b0cf36717416009dbfb5b89affd9a88e5c94624e
- SHA512 92dbcefd624742c2d26db51cbe246a86088b044cf15469d3f606d49d7e0e0514f69a79ffd72741feeb7a565de089d86fedfb4b0a17e450957d73b03437d3dd0f
- SSDEEP 24576:wBS3jZ6foujZ6X1jZ6vCjK6DLUwROuTgmf3Kjr6ZjK6xjr6mjK6ajK64jK6QjR6+:wSyeFma8mE
- TLSH
  T1BBE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  QuestVault-0.9.26-x64-win/QuestVault.exe
- Size 193.4MB
- SHA256 418af40a5475363dcf079cf88753f61b2a27302e08ceffd75c1f53685d3139b7
- MD5 99b961b0c0733d2918374c6f97108293
- SHA1 4de2109816ec32a66939a2f96ec6f8a66f82cc1e
- SHA512 c9975aa4d62ad6f01fcef824b8a534b65dc7d07de90a6b8e9e55a53eadd82feea243150f9cf25f6bd755118abd639d82474e7979ea047980a9f7a2bd851d17a3
- SSDEEP 1572864:FHM/7SRmD4j25lgATnMN1+i6uv6rsRi6a7hBqL3ANqgXWcBOCqVF5xzN0iq3RuwD:a/BiQAs8OvGK
- TLSH
  T1B6A88C13F39A10E9E05DD17587469633EEB1B8864328A2DF2B5407522F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral2
- Target
  QuestVault-0.9.26-x64-win/d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  QuestVault-0.9.26-x64-win/ffmpeg.dll
- Size 2.9MB
- SHA256 9da80727db8bb2760ece1aa5dc2a2ce9920e1794bed6de0ae63ec21924349a8a
- MD5 3210f5bd846b76504195274663731607
- SHA1 ca0fddee7b3efc98028f39266ee5f0f3ebfc9b37
- SHA512 7b7feca1aa7a73d98edd2690d83537717baea9c3cf1bf8fa75f18ec4882c4d33b1b6c57290cb28a14272aec3581efe341884ef6c16c9d0239c3012547cc0aaab
- SSDEEP 49152:HsZovSNDmM5IGHeo9a12wL+bQmBhj0usks6jENRyD9HefWgbjhpLjIEb4t4a5Y3B:sDOGHeo90usks6jENRyD9HefWgbjhpLV
- TLSH
  T198E5AD07F6D6109DD029C070979F9213F671344A8B2065EF26D08A243FABFD86E7E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  QuestVault-0.9.26-x64-win/libEGL.dll
- Size 481KB
- SHA256 a6d315c7ea7c240f6c82afa57b39b96191a62d3f5a0d25982e8567395ecb4694
- MD5 0923b2b6f9a88791d7e42a229fdf84bd
- SHA1 d3719daa82b4b95e2f1735548c71d77dc8651a72
- SHA512 4ba8001822cf9abbbf0852ab75389ed6d892504f699d85e015f20b3f28db1aa54f5b171b4da546f1318f8c6044abe06c56f7c27621d039cf706af5b615a67cab
- SSDEEP 6144:/Krfdptu9AvnJUCu536qq6Z64Vc+ALNwYyn23:i7dpvnS506Z64VcJFg2
- TLSH
  T158A48D15B3D948A9E06AD1348A474642DB7678860B65FBDF03E093792F3BBF45B3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  QuestVault-0.9.26-x64-win/libGLESv2.dll
- Size 7.6MB
- SHA256 71cc200c14725793888932d63142bda9ca6b4d2988c7e16d44387351c56d68a8
- MD5 5056eb3e4a076afcc9bb8018e783746c
- SHA1 7b9ea35aebed96e36c55b8f72d6137f280dae647
- SHA512 223ba329b61a5a830d5cd0f8462d2d2d3a47b27e082bd694815f3f62b3715a8ec25cbbc069f09d3001dfb8c473019eab2ac3287e544f02ddb973ded4d647842d
- SSDEEP 98304:FaeBlw64Uag0hVPrTg0gQo1JiYIjGJXKt7:YeBlfwCoqw
- TLSH
  T1A5867B03F39940DAC04DE2B8D7579626FA35B8850734B6CF269407292F67BE0EB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  QuestVault-0.9.26-x64-win/resources/app.asar
- Size 10.5MB
- SHA256 5e1c84ecbd338f71fa7b33ff4a2d38c75cee753dbe5aa122224fec3a496c934b
- MD5 062bffcb36838529c375d68e6a6f9a9b
- SHA1 c25b41608f2206e9b27bfd2b1517e23c65efeaaa
- SHA512 544dfb61dced36d6fc2c87c64b0339e2afcec67c02915f67c682dbc5884724a4974deaa77bdf4fbc4511f95f7e599375a14534c6167a7d9bf7ce6acfadb6ce2f
- SSDEEP 49152:YrdV3zdT3d2dR3R3ISSar4o6AqhRmRX7KS3dpcdaSYP4nj/3CnVypuq11mRX7W1q:IxXy9BBQvpTlWd
- TLSH
  T1C8B61AA9A8A325229A13617D5F7F55823A3980131D0CFC647A8CC2A84F5D51D62FFFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  QuestVault-0.9.26-x64-win/vk_swiftshader.dll
- Size 5.3MB
- SHA256 d61ad23a0a6d3247db5bccc1e13d00be89ee6804cce17cf9dcb156705441fba4
- MD5 3c52c8865a1483fbeed9f692d6297fae
- SHA1 379ca6a447c9a48a2e4ec0fbc138303b080e3c35
- SHA512 56ebc5d4c14c9a6d4e1e1bef16aae7584ca32291c22fcbbd9922ceaa571b31c876164cb53158bf7dc5a3724624e35eb79e70a06606d1d170916cf34da7cabb28
- SSDEEP 49152:UEhLYagK1ubn6vRClpqPO/NeitQj6LSnYClUmJY3I8fhtWgq12bGlQZ4jOQUPVdk:U+LDgKwtk2kJe4V
- TLSH
  T142463903F28680E9F05DD679875BA622F671BC811B62B6DF52A01F192E37FE06739701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  QuestVault-0.9.26-x64-win/vulkan-1.dll
- Size 886KB
- SHA256 3871c971466dc0c38e69a857a1d572b5d94e12f54b12415335cb83638680d508
- MD5 b549b5b7829fabe2746c79b2790207ea
- SHA1 42f8efb093dee829b20ffc87eec48dab63bfbbfa
- SHA512 abbf36926443eb355bf68d85f4cc01b6ee29c476206d4c74ff2f52ab9d33593b0f86824ab3a09490999059c392a4119a50f41e1db617883a2bb7770255f276c3
- SSDEEP 24576:SIaCHa0jpNtRZLAXb2F8Kx6Z5WSDYsHS6g3P0zAk7m7:da+/jpDRdAXE16Z5WSDYsHS6g3P0zAkK
- TLSH
  T1FA154B22E6948969D47AD034C9C28707C9B174922326B9CF02A81714BF6FFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9