f420a10753d5d4c236d1dce9fd7f22e2e4eb346288a9db6cbb58b22e60f76967

Sharing

Copy URL Twitter E-mail

General

Target
FreeYourMusic Setup 9.32.0.exe
Size 95.2MB
Sample260910-kh5q9sak2v
SHA256 f420a10753d5d4c236d1dce9fd7f22e2e4eb346288a9db6cbb58b22e60f76967
MD5 43969447ff8bae80bff3435e18668d91
SHA1 cba938648c10cbd6c88b3d828eda113f3f826740
SHA512 3287a7f0054fc03fae83bded0291dc13421ca94a21fa17c025a2a2c4c5d8bb19b9080f451fedb3fd74e4ed59c06faa43acefeb18df7356252bcd64992f0dd247
SSDEEP 1572864:fzFJsHnfU862PL8DahYbtM44wncYQkSSFKOIm4N+8ncNRZEvf6:fpSH8L24DaEtLnvQD2NQNlwRivC
TLSH
T130283397CEAE3754E3BFB8334A5FAD242C7B9DFA41116AB740CE3095973E522160049E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FreeYourMusic Setup 9.32.0.exe
- Size 95.2MB
- SHA256 f420a10753d5d4c236d1dce9fd7f22e2e4eb346288a9db6cbb58b22e60f76967
- MD5 43969447ff8bae80bff3435e18668d91
- SHA1 cba938648c10cbd6c88b3d828eda113f3f826740
- SHA512 3287a7f0054fc03fae83bded0291dc13421ca94a21fa17c025a2a2c4c5d8bb19b9080f451fedb3fd74e4ed59c06faa43acefeb18df7356252bcd64992f0dd247
- SSDEEP 1572864:fzFJsHnfU862PL8DahYbtM44wncYQkSSFKOIm4N+8ncNRZEvf6:fpSH8L24DaEtLnvQD2NQNlwRivC
- TLSH
  T130283397CEAE3754E3BFB8334A5FAD242C7B9DFA41116AB740CE3095973E522160049E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  FreeYourMusic.exe
- Size 201.4MB
- SHA256 87411d8f784a112f35755fc3f1ec6b0162ef16c9e6a7b9e73458efef9ec5e029
- MD5 64605714a8fd1f68d2e2516169ab9fb9
- SHA1 981d9d47a6d9d717653ddcb740a05164fc114b34
- SHA512 88dd2b3046749eca43625e8f3544533c6284ad04438134e3093cc2148846742583c7bb54641f6fd669e96357b6a3f6c45f18cad962d7040f18d1c6f3acba7200
- SSDEEP 1572864:SlstXKZiWIfzlBqAa2fthfqL9IkQ0WK5X46jkimLu8hAGCphsP1ym1jkToOpHKE2:Sq2EdYcmva
- TLSH
  T1A6A87B03E29601E9E05DD1759B5A9633FE71B8094724B3DF2A5407922F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral11
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH
  T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  resources/app.asar.unpacked/node_modules/fsevents/fsevents.js
- Size 2KB
- SHA256 1d75660f48786792f0e98d6dabfd301883c8f2a8f61aa690cbf58fb4386c0f1a
- MD5 40633f94741cbfa9d4e2a74d7ed01b2f
- SHA1 3e88cf9aaf616d665648c8f0de0202615227b0c7
- SHA512 1ddcabb62418f951c96d2aad43835d429738d62a78c5ef591a82310b8b5eb67aa9a936b93b37789cd3f8008af48650cb6a6f4edc22f6399bd1aa2ab667996e2d
- TLSH
  T16E51D2BD36D2604742AF34652666644BB77E44F6E30D4C90A5848F243FD23A842FBB9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/ClassHelpers.js
- Size 1KB
- SHA256 e4e6f20d8beab7d4804ed6fcfc14f463b643efe7f620068dc08256bc651e58d1
- MD5 4835df676eb971fc7cacd7c857e0c09f
- SHA1 4f753da4e6cdc3b5d4b75189dd9dcc2f2a083d57
- SHA512 3f2de60fb9bfe7909336b245702159f57cc8b7d1e4d1602546c97e6f94d7c1ee30e635710b96b6071a634e6206bc146da8923d7b2e427c5bca551d4816c6252f
- TLSH
  T1E931122C29625AB307A54C90DE0F50879699D006E35EE570347CF3574F18C2C50F6EE5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/ClassMap.js
- Size 6KB
- SHA256 2587c1d5045f4821062b4838e6f94aa754955e9893fdaf80df0f41771ea16624
- MD5 f18a79807288b47b96ae663aca815bfd
- SHA1 6324d90e8bea8e6345dbdbfb3e5cb87ea3d1082f
- SHA512 c8563dfe8eda3750c4997da1359658568ee5aad008e3763238553232b13d1cfc94aac9986dcdac729130143274d3cd1acca822116487b5662726aacfac0c5d36
- SSDEEP 192:uDAx3HHr7DyxgmKkflrHXCXdXGPZShuLNTiXZva/skr0PiYo:E83/DexrXCXdXqR2OLmo
- TLSH
  T155E1E208FAB1E9A006E3A0E4461B6083F1186513F13CF9B4BBACF3A55F9511952FA6D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/Collection.js
- Size 5KB
- SHA256 7432ceec287fe7484f5b741dc6271fe7f42c5c7825a28156bb6b618c4d90f999
- MD5 15bc3235d581aad9a639557e62446934
- SHA1 cfc856e82f8a8f8ec2e9de9aa7d37c8d8b98d87c
- SHA512 2c0d511bcae3cb4be6a677230dbdac72317cd5fc5815260aaece76b9684c2bb1c8f826e1b98ea389622969dd30a1704a63dbac1f60072a14050c1ea2f93c4608
- SSDEEP 96:uDAx4DMdNHFmAE2M8/C7NXievewZ5yXhJnXk9wia+0Nch0rCwuZ1p41+Q2mlpZgP:uDAx3HHrTCZiWRy/Xk9faLNHrCl1p1Q+
- TLSH
  T109C1432E3AE6237106E37797264F52D1D326C53B66265140366DF3E40F11B38826BADE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/Configuration.js
- Size 4KB
- SHA256 40ef4bdc25fc5de238524f1c1390cf21aa1cee1d76848ce08bbaaf35c3a4269b
- MD5 7731e90532386c39482fc9f560073f71
- SHA1 6c10441e4c638a437d1bfb82b4cb43d2e3290abf
- SHA512 07aaebabc6fb7595535a2026ba86c1ca8fba12893e7d2e82657e55cc975c30bf54b93803e1fcfac22307bc9bc07dc33ca66007e89712e75483e125c5fc3df43c
- SSDEEP 96:uDAx4DMdNHFmAEmVUyA1b+vTrSTK6Ifsm5wMHX4D6gvm9bJfdSRAQeqPZup7:uDAx3HHrtM1b+vaSsm59H3gvmbd6yqk7
- TLSH
  T10B911D40098A0E2704A37B7FA85EC0972674CFAB511485A4F53EF04C3F99938B75BBB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/Counter.js
- Size 4KB
- SHA256 b7c629f5be688adba6cae532036436395984dca53bb086e6c4ca602285ed86ea
- MD5 ea3b6ee6b92cc20771c66857c14d9efd
- SHA1 ae287524d4b58a704a011a5f7457204e710eee8d
- SHA512 efe6d38a81f3acc03aa3de55270482a9f165e7b3ef720b72abe8d948fdb0cde1a72d42853f6bc2555110340683961e0fac6c28ab031590856a58fcede50033ef
- SSDEEP 96:udAx4DMdNHFmAE3jtpkbbZBDO9LWQ7sMwp4odcklytDko0VifOQyOwAi8uwHjHcE:udAx3HHr0XmToZLkAtDko0Vipy2i8Nio
- TLSH
  T1FEA1772D7D9313221923A0BF721EB0F251019337996795CC74EDB2702F66E35569DBB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/Dictionary.js
- Size 10KB
- SHA256 347bf94549f12783600477eda21a4043f6b792797a4f8c7c9dff0f45dc5ec714
- MD5 d23368077ce2dfc2681b0eba94558eaf
- SHA1 e28cd2a3db68456e6edbf8fda42a798ad9e57fc5
- SHA512 e0ce061c3a854e78c492a681322eec0b0c35a914157ac869acf21461da7b0565393d68101735c8741df261543ea94d5cb9d2bf6fcab7ec3d8245a7698856a3f2
- SSDEEP 192:uDAx3HHrefAXyMv5Lu6C82VubMnbRXXf+A6pULRX1yaz9tyc5yiyzSiy4b8iclHV:E83q4Xv9J0nbNZ9XfQXu12E7codQ2pIM
- TLSH
  T13332975B7DE32620066321B5270B8081F53AA51B612FD8D8F9BC73B09F51A1C46F77E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/GeoSpatial.js
- Size 3KB
- SHA256 1d1b683f71fde7dd37c629c00afd036e9e6128de67da78e5eeaab749b70dff28
- MD5 1d3efe399c1491ed01f90fe6f0173c4b
- SHA1 c9fac9c97289a09cc114c82384c1f041916290e7
- SHA512 2442308416a9c5f6a743812fef248334ce75bd323b56f9f2f2061ebf68665fa328201c96af939560a51af957f3d039eb9f6e440b81cbc0c2dd33e511b5789402
- TLSH
  T1CF71017E39F2294182F325F53A0FC1857919D03395A98992345D76902F2BC3C75ECB6E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/JSONCacheMap.js
- Size 1KB
- SHA256 998535b3ebab97fdab5e43bacf32d4e73a2ec1998690ae7bd60e64834e8171db
- MD5 e60b7a5633b11fc9f05fed63cafa146b
- SHA1 a2d81f8168490d1d944734b048ecffda00392b13
- SHA512 be4878f08be34e0ed14eb6bfc7996d32b34f20a9ad5cc075c8d0cc560b629f120ee64bc11563df46194dcc8e65dd69d9bef08a96525a3df0038c3f0072dd82cf
- TLSH
  T1FF31E06C3B9659330380C4999D0F50E3E489C456114AABF9B8DCF1E85F354955AE4FB2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/realm/dist/List.js
- Size 10KB
- SHA256 d7fdab21d1fc42c6d7c867f399e811698c8483421999e51d9ae79ccbccb06e9d
- MD5 c4f11af4bbe6e292dbd0d0ffae364b28
- SHA1 a9e66cb8c5eda4925e38271d33d278340ffb573a
- SHA512 f0bb4ce46698de80f6cd097ad9cbde10ff54f0e561cfe7944485cb80bc885edfe040d7e7947780cce76b8fc3faf90d586332ac211a2631e2c17ac6f2814f7e31
- SSDEEP 192:uDAx3HHrKPwqR+We5XX0Xk6WUkgbtNxbPPYpiFuqEQ2qzoErG0liPuqEQ3ZzaMVB:E832PwwQBX0Xl13YyuqERlEC0EuqEi1n
- TLSH
  T1C532551B3ED71732565231BA670F14C1D167D51BA2BAD680702DB3742F82B28E1FE3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32