9daf0057fc35eba58b193844c088f95b05d7d1167a690f2b6f8b5e440d468070

Sharing

Copy URL Twitter E-mail

General

Target
albion-online-setup.exe
Size 78.8MB
Sample260908-vg6bhsgh28
SHA256 9daf0057fc35eba58b193844c088f95b05d7d1167a690f2b6f8b5e440d468070
MD5 c6e3a1ed465906869f9d8177932701bc
SHA1 f78be508674e384b0feb1883406b7c2b2f0dc64b
SHA512 c0c055cc0cce7ea3ae0f8d5706b467de7072b596ca6dff0baab7603812061c00c1b93b8ae936af9cff36e05c2f09c046ace6a19c07a5b9c8247789d331f8c806
SSDEEP 1572864:X08Fad43QrtSiO08EAsIgjEqejh2mnwAyEC54rQOBoTHYxdAy1SNEv6:XXFad3rtzP8XCenj58C6mdT1W1
TLSH
T1240833472CE3E6B6C4B60678C0B7C07F11B5F69E818BD7E436E9AF9324148608B5961F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  albion-online-setup.exe
- Size 78.8MB
- SHA256 9daf0057fc35eba58b193844c088f95b05d7d1167a690f2b6f8b5e440d468070
- MD5 c6e3a1ed465906869f9d8177932701bc
- SHA1 f78be508674e384b0feb1883406b7c2b2f0dc64b
- SHA512 c0c055cc0cce7ea3ae0f8d5706b467de7072b596ca6dff0baab7603812061c00c1b93b8ae936af9cff36e05c2f09c046ace6a19c07a5b9c8247789d331f8c806
- SSDEEP 1572864:X08Fad43QrtSiO08EAsIgjEqejh2mnwAyEC54rQOBoTHYxdAy1SNEv6:XXFad3rtzP8XCenj58C6mdT1W1
- TLSH
  T1240833472CE3E6B6C4B60678C0B7C07F11B5F69E818BD7E436E9AF9324148608B5961F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH
  T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
- MD5 675c4948e1efc929edcabfe67148eddd
- SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
- SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
- SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
- TLSH
  T15EE10A3574C02CF7D0CD49743816791B83F4C52527BA05B04A7B1AD576E1AE7FE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $TEMP/vcredist_x64.exe
- Size 14.2MB
- SHA256 4b5890eb1aefdf8dfa3234b5032147eb90f050c5758a80901b201ae969780107
- MD5 9f096b97d204078b443dbcbf18e0ebb0
- SHA1 a55510a8c9708b2c68b39cd50bbcaf86e2c885f0
- SHA512 c606a3ac915a62608b71bd3114a9725746f17a882420c38eaf905c3433a95187bff61013b8cf1af2013cc504ab07726758388beef2063709af253ffd2d7572ec
- SSDEEP 196608:cRjJHflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4IWSCvG2hCsPOasObofyOrjLUclP:kBlptVYmfr7yBG/4I0vG2hJWjL5sKJ
- TLSH
  T13FE633726584002ADAF30473AE95F5241E7CE628331489ABE2DCED6D7F7519227FB702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  $TEMP/vcredist_x86.exe
- Size 13.6MB
- SHA256 caa38fd474164a38ab47ac1755c8ccca5ccfacfa9a874f62609e6439924e87ec
- MD5 35b40b21383ac38487ceec8ab6e53565
- SHA1 59894bd9c96361b475c3b4b7ca9719c72e813d04
- SHA512 3a00b40ba8cd1cf8a523efab656f5b8910a3b07f9d8fba4ffc07745165b6375affd77b00fd3064fa72fb984c1773438a39e67a55363be23dd8fe1727c1016b8e
- SSDEEP 196608:YRjTzJ/BflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4wgi7For4PPKVj4rKwN4vONhB:4B/9lptVYmfr7yBG/4LC+mN+WKCnToNO
- TLSH
  T1EDE63332A649813AD7F70973AEA8F5142E3CE518231589BFA7DCFC1D6A7418227F7211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  Albion-Online_BE.exe
- Size 1.8MB
- SHA256 67d55c4b2f565a35b709434f21925f846f12d4f394d0e951c7186f919c88cb00
- MD5 a7de9ba9d9555f4060bda3231ca82b2c
- SHA1 a6ff841c31f2ff077088bbbb680dff1b10612ebb
- SHA512 ed22d7abad9e40f62faa1a0558c4e6b6ded8b0237e98cc88e401b816af4075d4a54e8c0d9ab92ef15bac4aa8997660cc0c45f92f8c6033823263f206698feeed
- SSDEEP 49152:Cg/IHEB+hN54ycfnwXhglIZmLk8J1xy5wf:Cg/Ia+hVXhglIZmLkc1xy5wf
- TLSH
  T1FA85CF01F544E0B1D8DA8C3479B7C63E19697C6007254BEF8B903CA67FB07CA6639E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  BattlEye/BEService_x64.exe
- Size 17.8MB
- SHA256 1d325b52b55fe35997a5669ed609d1c8877b7fb1edf599aa736a0fd86704395a
- MD5 25ece00e21da7aaaed96c7f23c38bda4
- SHA1 678cec4e01500eabf6c7572341cfd7dd284f2677
- SHA512 f114e23d8a3df76ade44765361abd2e3fbec871b9420a63945eddca14238a3e6cfd53d7515d76c10aeffe92bdf4cb336eb9a52bf2a0d82156412e667dac5163f
- SSDEEP 393216:yuw3946MRfSdjz5qPc2WbSQvRHyfxDRQDfZtXTBYSG2Bu:ypbMgdPu1WbS8Hy3QNtXC19
- TLSH
  T13E1733C57ACB965CD0668D24B1878368B2E3339DD0FF4F1E39CA6D127BE1D028E5152A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral19 behavioral20
- Target
  launcher/AlbionLauncher.exe
- Size 2.2MB
- SHA256 3ae9469b4fa38268f15bf81a927a8b6e42a74d3040a9fa7eca3f76bb55547795
- MD5 594505989040281684434d24b32832a0
- SHA1 f03c92797024f336f00494d119a9054840243c07
- SHA512 bcd169186681d9b8a86cdfe97d4c2446db6f286ffdeba3ad59b96379b5ce930d669930495bf3b39f75fc84fb9d2ad2b9bd87420ee522589ef939127e0308c1dd
- SSDEEP 24576:5VLjM0IWF1SwvA75Wcfp/d7RFyuUR643zSji5hptRgQ8GyLSbkUi147zrL6STMmJ:HM0IW1SKhORFl143u2dC9glTbVGFnlG
- TLSH
  T1F2B5E0233611B236D372FCF4491DDA2A441A98582B62D2C3B2DC3A7936745E35F3A937
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral21 behavioral22
- Target
  launcher/Qt5Core.dll
- Size 4.4MB
- SHA256 de43833036c338f66a3f3b1edcc2b5c638d4850edfd6a6d81a4bf83a736784a5
- MD5 50ea7d7934cb508b10262f7dac8ae5db
- SHA1 90a536c18450974dd7bb607db5f9dba44a0045f4
- SHA512 252cf773cac504e69692839e70d2b9dbac11036a56db1430233f9c48350267805b32f8bfc96b02498d272d1dba2f8040cf198d98d66773def488f50f43603642
- SSDEEP 49152:5UPCF1VbWpnqeOam5PKZowJeS55bpVJsv6tWKFdu9CKTVnWCLZgZ3YPmWjZ5RPpC:uPCDw7OdiZzJP5pJsv6tWKFdu9Cn5b
- TLSH
  T108268EB2A756C636FAD292764CBAD72F0425ED150B1185CBF39C361968306E23F3B14B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  launcher/Qt5Gui.dll
- Size 4.6MB
- SHA256 b512b1501e06de73bb7bb9092b5a90951ed1fbb6f7907a24e7df59dca58a0846
- MD5 409be3a289e31fac1b2928a2c174309b
- SHA1 9eb1a59038c781ba32b16a4e253da317eea06c61
- SHA512 659f500ae59796a199f76d5b3f9154e029013837b56c278763ac697e166ac3f6f58b829555411e9d1d08c5008f82c5c2fad207dcbd187632c4cc9246095c1fde
- SSDEEP 49152:p6gNU6GJR6eHXBiYmfLcReWUzh14XEES/je6UqAdrRNXD7V69GgmjkcCcmvV:pY6eHX4RoS/glPjqv
- TLSH
  T1EF261AD1A0867173CDA3D2BA270F153FA1BAAD66C30487C3D554AE9444B43FB0BBB916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  launcher/Qt5Network.dll
- Size 828KB
- SHA256 97ca4e1730cee019aeddd7ac83fa4bde34d4913da8d1e095d75393aaaeb54271
- MD5 c9924d07687205687167aa528b7fa965
- SHA1 6186c084a497396b504dfe1132c14fbfa19d1d91
- SHA512 550c0b439f11642c6c53478c6ed7db8acc8653ccdfd2d7c60b132e1b20a19be41862659a6aacd021e175d978ee4f86ca9bc1a0b2cacdf71a40bc1a2be324195d
- SSDEEP 12288:fXQgOfDiyfEFzEc6RSv9Rd+c3AcQBgnrIbAVQcj15X:fXQgOfLMFwc6glQcnncb6jDX
- TLSH
  T1AA054B52E38B01B3EA9443B6445DABF7E03EB11547325AC3A319DF2651632E66B3E1C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  launcher/Qt5Qml.dll
- Size 2.4MB
- SHA256 a8d3f72fdcd1d8d5a12690458da51e148ba954e1bacdd8999692eef01d452eff
- MD5 a3db2f22b836ac280d22e80e785cef6e
- SHA1 45a07c108c20202cdae3bfdf42b51a9d69b9bc52
- SHA512 6213a30046c0dcb6b7009a96e7c92ae3b77d48be16723512d0abc088e180aacb14b9cbc9ba018cafb203e2b6b4198ba0c9001d6aaae141e11bb3e51f8feef8ae
- SSDEEP 49152:T6FpTWjbESC7PMcNIQJ1sBX/ddpPIrgy:T6KA7dPXsBX/p
- TLSH
  T141C58E83738E41F5D0819178886F9E37CA72F1180329EFDFD3AC69A951716E25D3E286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  launcher/Qt5Quick.dll
- Size 2.5MB
- SHA256 1444997126b155c690b880f6743be3eb945f8bf95bacf6457aac31ea49191417
- MD5 4c6ed34f64cea53660729f9fe8536569
- SHA1 47ff733fa4d40c3c4326b3fc898e1d23c7492fa2
- SHA512 6cbfec413e47a30f6ecb8c0089e3480a038b4b050eda84f94ebd888768d651dfbcdd2d0a4a2fdb7ee833feac39c5e03190ead0f244c1cbecdf54b88efc4e4d23
- SSDEEP 49152:F7qZMey8K9lNuzckC4NONIWGU7L8C3pqb:pqZMevK9vuzSHI0XTM
- TLSH
  T15EC58C51B1C3C0B2C4C5A2B70C8E9A639639B0484B5966DBF3A4AF9D54B15F11FBB3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Reads user/profile data of web browsers

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32