df1dc6af8819034c43c6e0b5131ef552e119b017ca3b7c0ef50d162a8a5afa51

Sharing

Copy URL Twitter E-mail

General

Target
Badlion Client Setup v4.4.0.exe
Size 132.7MB
Sample260912-m2sbdsab87
SHA256 df1dc6af8819034c43c6e0b5131ef552e119b017ca3b7c0ef50d162a8a5afa51
MD5 788bd7a8dfabf1bf0335593b48ff0c01
SHA1 b95077e06713dad907fdd97e07759232b4b99f88
SHA512 74a521430c1b9fbd4e6c2b0977fb6b6e30737d1afda0c63cf17043575115fb50cb5cb70cef93970422ea8bad78c95e21c59d77124e5bc17af43185d5c4581b5e
SSDEEP 3145728:XATm4rQlvAmHqgVbdd0QP07bY+wMOM0RN/dkdqOsHsGZns6HJjBEiuL:QC4rQ5THdpd0Q6bTwa4N/+qOsMGZns8O
TLSH
T1B96833B54C876827E505E5B3228049DE8718FBF1F6871FEB76B98353F09BA41620F186
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Badlion Client Setup v4.4.0.exe
- Size 132.7MB
- SHA256 df1dc6af8819034c43c6e0b5131ef552e119b017ca3b7c0ef50d162a8a5afa51
- MD5 788bd7a8dfabf1bf0335593b48ff0c01
- SHA1 b95077e06713dad907fdd97e07759232b4b99f88
- SHA512 74a521430c1b9fbd4e6c2b0977fb6b6e30737d1afda0c63cf17043575115fb50cb5cb70cef93970422ea8bad78c95e21c59d77124e5bc17af43185d5c4581b5e
- SSDEEP 3145728:XATm4rQlvAmHqgVbdd0QP07bY+wMOM0RN/dkdqOsHsGZns6HJjBEiuL:QC4rQ5THdpd0Q6bTwa4N/+qOsMGZns8O
- TLSH
  T1B96833B54C876827E505E5B3228049DE8718FBF1F6871FEB76B98353F09BA41620F186
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 9a3c2fe5490c34f73f1a05899ef60cfef05e0c9599cd704e524ef7a46ead67ba
- MD5 ba2cc9634ebed71cea697a31144af802
- SHA1 8221c522b24f4808f66a476381db3e6455eab5c3
- SHA512 dcc74bcedd9402f7ac7e2d1872fe0e2876ae93cf8bbd869d5b9b7b56cea244ba8d2891fa2b51382092b86480337936f5ec495d9005d47fbfd9e2b71cb7f6ba8f
- SSDEEP 384:Zhyd8Y6pu8ZaLf6Uksnw1g8BUcyHisUVb:Zhyd8Y67WGg8B/EiF
- TLSH
  T189623C45AA6084F2C7A3167034E33A3E6BB18F751A1485C38BF35D4EAE15317B33A987
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Badlion Client.exe
- Size 168.9MB
- SHA256 f6a14bc4f038640b5823b50515d933691cfe77a86bb78044f5e1a166507b49f4
- MD5 8ec84e9c59e29b954a4bc1eb559ff4db
- SHA1 a8ac6061240aca6ed6625558e0abd7e61c98f7dc
- SHA512 9ef1261f118e8afc39aa3fa3464e10a12649e21f05be00ca906b9382a33ec26866bbf7043f3663a0b686fc21dd41141ae2a7abae8d8ef8a97a15553b874404f9
- SSDEEP 1572864:RHHt7MS+5eN4KyKpaRpOxS/krGAbJr3OIrMrpA98836lPCXg+ir70aDmyEgiAKLK:5ZMzBOBylar+
- TLSH
  T1AD888C03E29A51D9E05DD1B18B979233EE72B84A4738B2DF265407162F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware trojan
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13
- Target
  LICENSES.chromium.html
- Size 9.8MB
- SHA256 921452a09f92f10da4cfef0521acd6ee6c689c630661ed35189e793de2c99fc5
- MD5 b620990ddbd932d6475152e5a833860e
- SHA1 70de0b3d7ffa77900f685c1788b32997a61ec386
- SHA512 ba84b5e6281dd64d5da41d0db35942b6c0b1ee6b47d24dedd5006be40b2d22d90f58dc653e17893347900fb1bfcd37b0f2fff5b532175ccacc3b63d98fe42ac7
- SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfEl6k6T6W6b6f6V6GeGj/3BIpx:LUcBeGdY
- TLSH
  T124A6A52F7B48037706C642627B8BA5CAF21E903F3B561654344CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  VMProtectSDK32.dll
- Size 98KB
- SHA256 6ff20283e407a0f2829e4fa6def121cd63d715dd6582847ae2d6fc379ac40927
- MD5 17011601817dd00866b681d4a0bd90f2
- SHA1 d6ad7087f54182b47a9a6776fab90cb03e95f80c
- SHA512 1e41669c920ac65fea5fd0e5704430dd371893155d5f33674ad6eec011ec16bf4969b01e2b9b28c561d131a032b599e0479931221819c677140d1b272d121abb
- SSDEEP 1536:OT33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwv0YXowGF:mhQC2mCYK3RhrZ9dPk2Q9yMJwv0YRG
- TLSH
  T108A36B10B4D1C432E0BE19390535C5A15B3E7930EF64AEDF73841AA99E742D1AF39E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  VMProtectSDK64.dll
- Size 116KB
- SHA256 889553cce491767b38df153b567b6da682709925dd7a1c23f12c6d53a9fb18c2
- MD5 6540242ff58d08c8849268cf305445b8
- SHA1 ba0d0c8875ed96f137dcb28aeff873373b994eee
- SHA512 073e44196cd0c4cdb1cb5004cca59da80e09b97c70b83f212344ec7b262f1a3a4ebdbdf059d9bdbc228545b49a269a8363b1db9180ff6565c94797b19cd3c515
- SSDEEP 3072:LmcqYHq7Aiytzg2ScpvgJcG5sqYX6U4HDlBS:q0Hq7AiyegZgJZSXwjH
- TLSH
  T17EC36C5BB3E540BBD1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  api-ms-win-core-console-l1-1-0.dll
- Size 18KB
- SHA256 49ac9f317d0adfc3761d6ff0d32844be70cc78e2af18319c9a2e2ec2a44d672e
- MD5 3463d82d90601b441cf024c92abe4acc
- SHA1 eac8fdafccbc1beb17386552922770bfe12ec1eb
- SHA512 ff4fe61c7dc5f8eb7012cc4867d7212cbf965ec786dfdfa8c74ecad8c582c4ac1107aa2876e5f11066908fbd07c1b353dc67060c28199a7e21d57adbdddac977
- SSDEEP 192:5wkETRQWfhWpBxQmLuDBks/nGfe4pBjSHM4+O38WebtuVaVWQ4CWaeOBqnaj87XD:BWfhW1Q7q0GftpBjj4+1ZFtl9V+H
- TLSH
  T1568239928EBCC683ED97AD7023E8E9837C3DABC35910615525A9F1D92CC33D1EB1891D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  api-ms-win-core-datetime-l1-1-0.dll
- Size 18KB
- SHA256 0f0cec83da06f06e9c42ffded72fa69c51efed881def2b4b7b88274bc1bf3d40
- MD5 ac3c4cafa028297da5037781f1156220
- SHA1 937c2b11c7fe4effc16e67af716563aee2419a0f
- SHA512 a2d1135f497e3831f14369978ae6a5ff74106d9d4ea0407548b6c336a1082bddd196424b292c799ce60270182c13e148971039cf29241e76203b069ebf7bb72b
- SSDEEP 192:fWfhWphuivT16uDBks/nGfe4pBjSHcKaRrJL2TI8WebtuVaVWQ4CWiRqnajjpxfk:fWfhWDTvT1Nq0GftpBjpanZ/RlBPin
- TLSH
  T1D0821AC1CBBC9483ED97AD7023A4E9837C3DABC71D10546A15AAF5E92C833D1EB1492D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  api-ms-win-core-debug-l1-1-0.dll
- Size 18KB
- SHA256 a20dc11ab10769b38cafb701c2d08810c8aa61350f0b33ae7838ff5c26edf956
- MD5 8c0531639f58f79b5b67b52edebb01bd
- SHA1 866f3ca8819440e0ba67eb935e688509f86ce1e3
- SHA512 d6ddcb814d7f507df03bd5fb378eae3bf30f31d0cbb41136382469297033965763dc20e68dc50108eeb5fb5996d167cf21b29dbdc0ea163521607e1cc75f7d9a
- SSDEEP 192:1WfhWweivT16uDBks/nGfe4pBjS72Ek7KHwDoG8WebtuVaVWQ4+WoRmqnajiPNQJ:1WfhWqvT1Nq0GftpBjGmKQDcZZ8lgeL1
- TLSH
  T1AE8219828ABCC483ED975E7063A4E9837C3DEBC71D20506605A9F5E92DC33D1EB1496D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  api-ms-win-core-errorhandling-l1-1-0.dll
- Size 18KB
- SHA256 79cb8a8781feb448fe051e90ccaf3d6ecdfac12c1ad4bba2730aa1f0a229c31e
- MD5 2a3c5cbe313f4105dce8a79f533e5959
- SHA1 26e6768280c83217ccbe36f3a405381defec12b9
- SHA512 e24ba69254b445a62add1d58269ee99841c36049f639671a311bfc0f60d965e6a8d79a67375eb0d3ee3be8cf998f182ff03291f0709ae2155bbee924708dd8c2
- SSDEEP 384:VvPWfhWBR4Zq0GftpBjITKpgZ3pWl3u7gFO:VvUG47iV2Bz
- TLSH
  T149822A928ABCC183ED97AD702394E9837C3DDBC75D1051A615A8F5ED28C33D1EB18A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  api-ms-win-core-file-l1-1-0.dll
- Size 21KB
- SHA256 38e535e9a79cd72e3f5e3c0ec9c97a18e86d480a504ea6c85854a6f70b302c3a
- MD5 4215700161720c767e725b1f7fc358ab
- SHA1 6e31fa39775c1c6c60fe8869761c31148b0a8019
- SHA512 8c93f4021544ffafa37665efcbfa2c4d23742573e695766c637c9449a39af5ea0de114c821a5c50b886ed1ab0f0a2be0fdda164884d73f7488402cfa2137e5b6
- SSDEEP 384:HBPvVXWWfhWkQ7q0GftpBjNhZjl78oS/i:hPvVX3Oi9Laa
- TLSH
  T144A20983D9B8E587FC8B9D302295D983BC3993C2082055D61AE8E2ED3CD33C6E798558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  concrt140.dll
- Size 325KB
- SHA256 511aba3d00b9925e7bc64e2132d77a76c1fd9e9d200ec0ef864b7a0f00c68995
- MD5 14b7a99127ca18df05dd1f5be3ac0245
- SHA1 991891bb1ea603a002941696697f48cfe52cf94b
- SHA512 80f1a6cd377e62c96979fb4cf50d70e3005623c8debdb3c55dd27e5bae9dd46328d18066e59501ecac13ee96533f3b5189fcc93b4aadaf376ef6a2455ea7eff5
- SSDEEP 6144:EMVzSHmHM61wfScgh70p2pKd/6D5St2O/TXgl+iAnWzgNTdRI+r5y:EYz49/p2ppMibzaW
- TLSH
  T15E643B5AB7244CE2EA63C139C552864BF3B2B8402B52D3CB1268535F6F677D0D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  discord-rpc.dll
- Size 390KB
- SHA256 5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b
- MD5 5882c37b79bae47a0d090006564edb22
- SHA1 ac7bbbdb1d34eb763d8db4ef7875a50f700e9d48
- SHA512 d4a6a1a36842dd1c8b2162168807b990e0d491a908e11b52ebf11174a67f818b131607c2122dbb484f5d946418a05a1a84d42e1468bef5c98ec3fcff7d225ccd
- SSDEEP 6144:TnQCrLe2xJLChxTC+LxTYXrHJZ5upQtXsK+62C3wh+0U1c5xrunBLko:TnQCrLXxgvU7v8ph7+0kHB7
- TLSH
  T12C847D5AFB6448B5D0679135C973864BE3B27C891B70D78F23A8439A2F37BA1453E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 c624147af5b16c2d7293fe54f13d11540c5b0572f5976c3ed90b49b23448d0ce
- MD5 1268e3c8fe56351c438de7e3e1af1e62
- SHA1 be1c096c70aa2fc848b4217bbc2def1003c94485
- SHA512 f230cda66bce2146c54a935b5a30b43ca768945c4fb3c584f912f82147b0a1ca08725859b62b5e8a2ce69dcf3793f8af2eb6985c3f8c6028402675a52eabfac5
- SSDEEP 49152:BC8lp7/1UNZrhOP9YJQHUOWwGen6yfW0OfShPdb5x:ehOVYJiUOWwQaPB
- TLSH
  T160C5AE02E6D904DDD02DC0348B9B9223F63174468B24A6DF1A91CA253F6BFD46E3EB75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  ffmpeg.exe
- Size 63.9MB
- SHA256 e5eb597f4b3bc7cb3cad73de7c750ebebc066a2e6457397a76ae54360abc1326
- MD5 c0e0d0c6605957969e4b34f72cb4168e
- SHA1 877abd924d8ef4fa44a8dcdd8379f5e0e29b33f2
- SHA512 5bb86e5db03c0dc1e6f8532b317d391dde04ce115d14c4e92703785bc508ed1dc4e5082c8c1a53d5e7004aec70755d4eaa335ecdb91b745a76f6841fe4cb888f
- SSDEEP 393216:1YD52UUA2OL0DDkVrLD/EKR0OtNWvunfXZgsiI0ofkOTK9ijxpEQxjcsZsssssXv:WDS2yEfeTWkOTzLlddZVMF
- TLSH
  T1A4E79D6EE2E390ACC16BC4F0436EE773B624B86D11305A6A16C59A343E27FD01B5EF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32