ed3331edc9c7aa5b16abb45c52c04475b02a0c89f6d2ddf6f34b36f1a400f53a

Sharing

Copy URL Twitter E-mail

General

Target
STREAMUP Setup 2.6.0.exe
Size 83.1MB
Sample260910-swj1qa1grd
SHA256 ed3331edc9c7aa5b16abb45c52c04475b02a0c89f6d2ddf6f34b36f1a400f53a
MD5 37669d7f8a129ecb5c37ef0f80099494
SHA1 c94e9ee459902707b27eff9efc255cff6ce061bc
SHA512 e976388c1fddc5e2e00d3606bbdd9e2e533c451bd6035dd38e47833a0ac96decd5cfd17a198427bd0be040abcbf1dd62903dbda0b99b9684045343ade2615e99
SSDEEP 1572864:iH2YcVeMajaZV+XfyK+/R8hpvM45nswi6ME3R+C/G3LX0l1:iH2YGgyKAeMM7ME3YxbX0l1
TLSH
T14E1833BD50A6B151F282CA7CFEE38B7098D43B466913FD7CB92DD58A42C6C28DC83645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  STREAMUP Setup 2.6.0.exe
- Size 83.1MB
- SHA256 ed3331edc9c7aa5b16abb45c52c04475b02a0c89f6d2ddf6f34b36f1a400f53a
- MD5 37669d7f8a129ecb5c37ef0f80099494
- SHA1 c94e9ee459902707b27eff9efc255cff6ce061bc
- SHA512 e976388c1fddc5e2e00d3606bbdd9e2e533c451bd6035dd38e47833a0ac96decd5cfd17a198427bd0be040abcbf1dd62903dbda0b99b9684045343ade2615e99
- SSDEEP 1572864:iH2YcVeMajaZV+XfyK+/R8hpvM45nswi6ME3R+C/G3LX0l1:iH2YGgyKAeMM7ME3YxbX0l1
- TLSH
  T14E1833BD50A6B151F282CA7CFEE38B7098D43B466913FD7CB92DD58A42C6C28DC83645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  LICENSES.chromium.html
- Size 15.3MB
- SHA256 1145a9faaadf10f97ab6a1d0c5b7f74c6a2eae46b532f168a233b9a5cd7d52cf
- MD5 632ae2b84ce5a7ae5c51dea5d5b66de6
- SHA1 62d8d66952166c8c32de54aef13ab57bb7b6afa1
- SHA512 f17fff1ae50d99b2454429bdb5ec5d39b9d5d9ac133297a5c8e16ca3451d35e3a95305c3c0588c0ea72eb8ced419ca62f0d42bf067e99f305088fae011688361
- SSDEEP 49152:/NQpqPgnqRweTYp2kGYC+O3r8xd2zJQf8xF6D7gQdGxw:0
- TLSH
  T1CCF6B56BBB49037316F242626B4BA5CAF31EA03F375A1654309CC15C1B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  STREAMUP.exe
- Size 204.1MB
- SHA256 220304272cc16bf82509385404a07c34ea5c2b24901c28b57b94c2a8afb8a6f8
- MD5 34d079c03d7acb498f2edc2fa61efb4f
- SHA1 acc7ffcb0dd7aff94f599a1616f5a3da1d9196d9
- SHA512 affc0a4e42d72ff08a80ed0f4d2038c42e3c6d43a3c7acf9ba82c10b6cb0c312e0aeca2df2e2e59b11475330de92cadc3e52551c1536fe6025f2e08dbaa49b48
- SSDEEP 1572864:7GF3qZJHvHemnGCDaMTRdtusuiTuYpmfHlcWSJN73YjHaZy/0gPovW74Sbj9ejeF:yF3m9aKIWPs3I5
- TLSH
  T109A88C03E29A41D9C05DD175975A9233FEB1B8094724B7DF2BA407522F76EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 ac082e3da7852e20fc434370594f485b181173e0b31d59bdf049cd698a166c30
- MD5 4dd4610da8cb8493cd5ef3c4dde42cb6
- SHA1 71403f9c8689a7006a5ba40651764ddd4aa1659c
- SHA512 026145662b47f1179c63535cfcdd44c6a50bfdd4557b4527ee52de312d7777a2b76af8c7b79d737dc5bfe9fb5e7270b08ae1cc92d48fd4dc2d021c812d85c904
- SSDEEP 393216:NDo0qtOp5zxtGlyWOLynvTWcRedqlB6P2RJ:yOPxBQvlk2
- TLSH
  T166473A122646D49CC059C879C7678B268A6C30E73FA7B9EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 dac252b5f8305bb16b7cff7e9b345149d815fd7103b253b10e680fe6f9b18bf6
- MD5 7c69d24304fefbacfb40508184016dba
- SHA1 d78fed931d846be33fd2a505c73a63faf335db3f
- SHA512 5d89c676896e6a36208adf31db2bf318e7a71e57fdb1bef195e41558379c48688d2e7657bfe35429584c9c4fcf5314ca6cf2736a3d4873f149484bea544976e2
- SSDEEP 49152:TWP28bu0s6grWFv/iGOjeaGgQbalS199aJLKIbk7k64aoijQrNoJdxljA6iPyfI:T028bu0CKiGWeL1bal9ZrNoJaL
- TLSH
  T179E59E02F6D651EDD019C034979B9313F631780A4F209AEB16905A223F6BFD87E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 500KB
- SHA256 7a5a93f4348142303fc1617b3751b922266ba1dc0b18332811bdcb70c0bd50d2
- MD5 8a357d54f3d6a6aeddc3350046851873
- SHA1 cb68378213af69be56255c55df9d50ab5d91db1a
- SHA512 cf9b40bb4f908184a7e5c053f4876d9c964c79be705513bf35dc513b5b02521b916a95d15039d01ccf055744480f723a799d5a6300d9abdcac0fbef91e316892
- SSDEEP 6144:RwKVOb8lys73EbAi3uYDbW1XJ5aihN5Iio64haxiVNcPPmWF3PdPN8kygV:RBKA3Z5XSiAaxiVNcPPmW1JN1
- TLSH
  T171B48E15F3E947A8D07AC0348A538646EB7574960B65F9DF02E052392F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 3049c87eb4ae02a13a22de529d66d6fd5627e659bffbd6ad82c14056b5013f1c
- MD5 5cdec47d0c0bcd5e5587b01ad6b4d687
- SHA1 630e139cc13f9a23d962668d26fac5e48ce4af1d
- SHA512 c46efccf10c7bcb685c4d45b1fbe75fadb1fd7cc180a1d8f9932e82228eb2803d420be1ecc3836a0fcd2ba1b84d856cf907ace12fa7e24150daba44d4a4fad1f
- SSDEEP 98304:PZqKv5yzkjFgW3WkQ6HqVokbPdzix7ZSYm:BqKYkjF46Cokbsm
- TLSH
  T169866A03F69681D9C05DE274875BA223FA35B8450724B7CF2A9453252F6AFE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 fb1c846f1fe82a8a7cbb5f438075d212aebea91210a61774c50cf8471c47adf0
- MD5 5479c0a7181220a3d7f46b6cd8524b25
- SHA1 92141e92873c30c9a30fa0eba6a82264615fe87e
- SHA512 3c3560eebb4a465b30fce65c578f30835a663fc305051ae606f05312690bf265e37909a042649985384aa2bbe5b6067de1d9aecdf9c6a2a44aa3cce4055887b1
- SSDEEP 49152:/RAYccoQajkjwWrTd/hMFsfyTpkXNYSsnt4p+L4lvgPTvFaHmJrL+4jopldbIqd/:/FccS3OQvNToxq3cTHIXP
- TLSH
  T1AF463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 f2420e9c0b4caadf05e622a159d5aba3b22f2fd3348f0ffd538b49d269a22767
- MD5 7327811804c6e294b98a65a1253b62aa
- SHA1 c2b2a441a31a9ce99064661fed6d4a5c48dada77
- SHA512 881085c8a1530e60df8dd92ea805ef3336a6fbdf15a9fa08c4c1e039f3e662380d43c94cf0816c9a30a067d6b428c2cfd3fd2166a07ef5926f64f6f3acaaaaa2
- SSDEEP 24576:0hlEEziaf58fg5rY4M2IP4rB66Z5WGcXDYsHQDJ6g3P0zAk79oOHTQ0:0HESiE5845U4be4rB66Z5WGcXDYsHQD9
- TLSH
  T14C156D23DA644669C976D034C9D28B0789B175822326B9CF02A817047F6FFF47B7D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $R0/Uninstall STREAMUP.exe
- Size 177KB
- SHA256 65f0cef61014e654ba3a72e40c40b8c924a34c1a82bd6eff241d95af1761c5ac
- MD5 c11f11dabe71b9d7aee34ef951687a9a
- SHA1 24a00407c698a856b88434f101343bd7924a9078
- SHA512 a108db985886d076c4f5cdab9cd11a5d27588f283490a00464e14bf99cd72a5aca553cb2c71c01b14b1e7e7c8c124c97d0b9d006c5c8a6cc9a2c125625a55d95
- SSDEEP 3072:wn77v00hEoDEtaupJVhIOeaRj5lBrzZkjxl7Ln0/WCaywMNUa8b32tvhOEA1RJCR:w740IZVIHaRjpKjxl7L0/pxUa8T2t0Eh
- TLSH
  T158040124BB90CC63D6F24F718BBA67AB9A76F51126281F473B84261D3C92381DE1D3D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral20
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral24
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Reads ssh keys stored on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26