4516f9128d4328984cc40445d3c63313f0f84fa9a8fc0431ed1ee63e55f8b465

Sharing

Copy URL Twitter E-mail

General

Target
Vesktop-Setup-1.6.7.exe
Size 190.6MB
Sample260910-nrwfqssdrg
SHA256 4516f9128d4328984cc40445d3c63313f0f84fa9a8fc0431ed1ee63e55f8b465
MD5 872d5a0637a4eba32b82b69586556d37
SHA1 382aae4714aa753077c3587c6cc36636cb2d9693
SHA512 ed3c8ac2ac4fdb220f5b0f5b85077d5b725f4174c60d8d56319d8c6211dc2026df829571415761b66ba6dd892141da5050b920610e82c81b98c46e68a20337f1
SSDEEP 3145728:6rLWKzQRHv/hfiH/19DvEzVohwowXHHqLWKzQRHv/3ONN7jIj6Cr7TZOTd6kDdE+:4WKURH3h6H/+oQUWKURH3SU7TZ8dbROS
TLSH
T1DB9833A6239AC24FCE6400F1B634A56BCEC16FD474DB2FDD2DC4AABAF130541A9D1391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Vesktop-Setup-1.6.7.exe
- Size 190.6MB
- SHA256 4516f9128d4328984cc40445d3c63313f0f84fa9a8fc0431ed1ee63e55f8b465
- MD5 872d5a0637a4eba32b82b69586556d37
- SHA1 382aae4714aa753077c3587c6cc36636cb2d9693
- SHA512 ed3c8ac2ac4fdb220f5b0f5b85077d5b725f4174c60d8d56319d8c6211dc2026df829571415761b66ba6dd892141da5050b920610e82c81b98c46e68a20337f1
- SSDEEP 3145728:6rLWKzQRHv/hfiH/19DvEzVohwowXHHqLWKzQRHv/3ONN7jIj6Cr7TZOTd6kDdE+:4WKURH3h6H/+oQUWKURH3SU7TZ8dbROS
- TLSH
  T1DB9833A6239AC24FCE6400F1B634A56BCEC16FD474DB2FDD2DC4AABAF130541A9D1391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
- MD5 c8e8384bda055e42bcdc54cda98574ba
- SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
- SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
- TLSH
  T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 41004dbf82da5dd2f70c92defe2f0e0fce030daf85c072bd7922917ec90a6c28
- MD5 29d337ed011e087bf561cc2128a2cae2
- SHA1 fbf717c0d0979fdcd17ca045eae697bb72330215
- SHA512 0447d1fa22ceb9191c02c54618b97b84a127607da6ea9c056d49508464a31b62f1c62f557355dcfeae285a61a9e1744c9aabb8c8ca2ad029b7f41ef90052ac83
- SSDEEP 393216:e3rB/qi9bG5sQInN1HN8YMEBfc6uOCv5:ASoN9MWc6u15
- TLSH
  T10D473A122646D49CC099C879C7678B268A2C30E73FA7B9EFC0F451252B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 d17c2a0ea5683ff02006676845b84ef2afe18b8f75a5fdcce2b364f85c37a34e
- MD5 5b582d8fd8e1d857746a46607ffb1e26
- SHA1 899e41b95907c9dd62a2d3cbfc102d0569bb3a5c
- SHA512 b82f220ed5ee02cf69846e63e33fd1bc64369dbee2286eaa825ee11bdbae2259306469760d11a6da3e14e02e056a91dff71e10f88b303210e3e47a323ef1aec2
- SSDEEP 49152:vhppXiAW075k/ZjSgbdzKKtBr4ZjB+JBlR9oMaLu1vj+Kd:vldVk/Zu+llaLu1v1
- TLSH
  T1FDE5AE02F6D251EDD019C034979FA213F271780A4F20AAEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 463KB
- SHA256 7d6f4957a6c4d4cad4d717ebebbc9738acf4bfdf2d4ea1c0403d2c9a0661dc5d
- MD5 b11898d11f7ecd4b6c85c8c68282d17c
- SHA1 4d6c34e557f1887a4e80670e4a5a17ba010587fa
- SHA512 ebe3c22200c4876ec3f4b031d7cc7f8ac91028ca14411dc52a535b08ae1ea280980da353eb1d9de613e920161ed76d02495f6fa2b4c46a223c4b0fc7178e4d61
- SSDEEP 12288:QPdPC2DvJ/pWfycv+1cbeMOOqOZCr9KLl9N:QPdP9tkre9OSM
- TLSH
  T1EDA48D15B3E549B9E07BD1348A178643EB71B4560B62FADF02A0D2393F77BE45A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 5d6c94812ca1f6dc414d6166da1ed95e4f072a151c7e16952b0fd9a450192d8b
- MD5 7305139e08adf38c4ea5b0b0a88e2ad8
- SHA1 17b9222294fef64445fac8694cd339be4de14bcc
- SHA512 f5e34f60b67666415e9aaa67976ab6cc329f716699682362d0ab9a28a4ae1868d92d93e85432cf773f79ff720929c3d150421e9183393d950f5dcb7ffb133498
- SSDEEP 98304:F73jPlBkam0Wis3DY0FzPHmiDjG9kA8t:Jjrkf0hEO9no
- TLSH
  T1B0866C03F69581D9C05DD2784B6BA223FA34B8450724B6CF2A9457152F6AFF0EB3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app.asar
- Size 32.1MB
- SHA256 a1d94686f3eb421f526c80d697d017780468d691358e0054ad1dce2920131032
- MD5 c3b93352840f7163ac28deb237f6494c
- SHA1 65a9179325182162b28a4147fbbe4574b96dc7b9
- SHA512 0da5b133c6f92559ac0884fe5e6a735af46112c1f2e1315c35703165b55c65e4489743d871a7175525dd2489316e71b84de701ee872f7cf446e48e49c6c6377b
- SSDEEP 49152:Athol8HRrXusb73TTnpf4VJuEaBVSUaV1VLDpFd8zdYMvhx53ADzsmBwi7shsK6p:DyaghxNrMNnD
- TLSH
  T1F2775450A433F92F74439B8F998F41767B0C3212EC44995464A88F2EF78BFB97B64990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  vesktop.exe
- Size 215.5MB
- SHA256 4ae91d45d3a9af610ee6e70bb537c91e39029b23c8bca9280993d0b5b6271932
- MD5 9d42e0b177552649aeadaf54f313bfd3
- SHA1 5014179b0a794ed3adeb7210dcae2e31e7f74f8e
- SHA512 48066c501e912224365450b522f48a3861774b105247a535dcb7033bc9ac8b4893d7fa8af308b39dfef432637eed8764a72cde758fef57ba1716e07008bce91f
- SSDEEP 1572864:WfE0+adM9RwfaiDjy2KS3HBycnCD6nQTfAr7GtZBPuPm0v2LFNrEmuFYZfhiJz+H:6dMFi/oN10hK
- TLSH
  T1F9B88C03F29641DAC05DC1B58B5A9633FEB1B8094B25A3DF2B5447922F66EF82B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral24
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 a0f117801db7c874cafca765aac0eddc4e07f422af5a38d6e673635ac5bb8a75
- MD5 7e92d5a596bf7e8419e31c7a7636f20e
- SHA1 2789cd7dd471035d4915ea8df755bc7194cdd98f
- SHA512 bd2c8283af37665eb3f9c13f3fc3f51f34ee822bbcec62f18165fe663ebc6afebb362e9f0765cf2987243f3ad199845d7cdabe4d0a298226eb153577e85f3c29
- SSDEEP 49152:4Z8LrIVVMgjlR2tLwDfXKr+9UbQ0hPBkWGurGIqbDX6B/y85eJfXwGzuQctlELcx:4GIVPqrBwiyh0thdoYIoD
- TLSH
  T129463803F28681D9C06DD6B9875FA623F631F8844B2276DF56A00F192E6AFE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  vulkan-1.dll
- Size 908KB
- SHA256 58349de6c50157aa78500d383910dbc7b40a8a4a022aff9cc3eeef8915c9b3ed
- MD5 6cab67214fc2b5ff9541568582079530
- SHA1 4602f92b3a96a0c4806508c3eacc5d2c12f32248
- SHA512 3b431a0138de1ef148eaf96ffa82d0868fbe50ad6956450977e6bbbfc96c3fe5941d1e3fa8b58ebf4967b1ecec51563c5916ba07a2f9b9f440d1f10f68423fa5
- SSDEEP 24576:uXIXgOa/C3B7xke6i9uY1sFSH6Z5WzcADYsHkDn6g3P0zAk76oOHQfWk:si1aq3BtkpfFSH6Z5WzcADYsHkDn6g3Q
- TLSH
  T1BF156D12DA64CA79D67A8074D8D14A0389F074821723BACF17B817147F6AFF42B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
- MD5 c8e8384bda055e42bcdc54cda98574ba
- SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
- SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
- TLSH
  T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  resources/app.asar
- Size 32.1MB
- SHA256 a1d94686f3eb421f526c80d697d017780468d691358e0054ad1dce2920131032
- MD5 c3b93352840f7163ac28deb237f6494c
- SHA1 65a9179325182162b28a4147fbbe4574b96dc7b9
- SHA512 0da5b133c6f92559ac0884fe5e6a735af46112c1f2e1315c35703165b55c65e4489743d871a7175525dd2489316e71b84de701ee872f7cf446e48e49c6c6377b
- SSDEEP 49152:Athol8HRrXusb73TTnpf4VJuEaBVSUaV1VLDpFd8zdYMvhx53ADzsmBwi7shsK6p:DyaghxNrMNnD
- TLSH
  T1F2775450A433F92F74439B8F998F41767B0C3212EC44995464A88F2EF78BFB97B64990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32