3dbf8240c9a478a6c1d5d1a41dfe79e66d19684c833802f1064527c69171cbbd

Sharing

Copy URL Twitter E-mail

General

Target
RestXQR_Printer_Bridge.zip
Size 1.8MB
Sample260913-ckqfcsssh1
SHA256 3dbf8240c9a478a6c1d5d1a41dfe79e66d19684c833802f1064527c69171cbbd
MD5 1697dfc97d7dceafefbfb7c89f429a57
SHA1 a8b15cb46b6835213bd3a63b35f49cbbf0e25209
SHA512 9fb0eaa2a8cc340e2a5d624c3ee9bfe67aa8754027ce3e8e07679bbec7b5790ab0f91e3b23ad3e5aeb7c17d8106804120a1c95cdc16cb6cc2d374b98230a6870
SSDEEP 49152:DYIck3SzF3TuHMkDzu5rylFqKbIUy2kIgooYNWosjS:DYI53SkHp3u5rsFTFy3ooYNnJ
TLSH
T1F895F095AAFB093BCE1FB67BF8C73861B8DC1BC984A1AD47564C42C41C761A44BDE01E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FULL_INSTALL.bat
- Size 4KB
- SHA256 7de48fdbd2d6fe1e770fb448462b3a4efa077e529b698bc3342e054dcfc8425e
- MD5 8ced381aeb0ec436b0db8d92b1149553
- SHA1 76dd7a1fe4cdb002698b47968ce0bae9267df967
- SHA512 ef4091188b89caf6d0a8d5a619f1858455d756460bccba4e53d5cdb7ca4b8412aeffca969e1f4a2c6932c327bdeebc7c71a9f5ed8276051e546e18e2bda0a294
- SSDEEP 96:tXlIh7BGqKcCva8CVJQRQv6DAFGy6DOp24hjZiiAt8n:5lIOVva7h6Vy6DO1c+
- TLSH
  T11591D81A7C948533299A85B1CF1912723B86904F11147CB5F0FB91B89E0A3D9BDFF9D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  INSTALL_SERVICE.bat
- Size 328B
- SHA256 e75023b9111bc422c740945f5343d60b60bf8bfad6e33c027c52094cb6715693
- MD5 4f9989908a5fc0b195209f52362f8ac7
- SHA1 55eced537bfc5e13012c0ebdc5026423c372c9fe
- SHA512 cad46ca6b166b2e5e25a121f3a05d0e6d8d9267d62eeaa0adb0335d32766532afe0f231a0db79a40f49e39c37572002bd453b4679a15de0e41b0e031020d1923
- TLSH
  T191E0C00A3AD126F0A0A104130DBB3817F915704781069C00EAD710787AC6080B27E8FA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  RESTART_BRIDGE.bat
- Size 993B
- SHA256 00120515b804353dc08a88ce93892be3ff6c41c92268c1daefbac305fef979f5
- MD5 7fcd9df9809e063a0208ea8510b03aa6
- SHA1 e65bebb6c5018aa6fa52ebed9308fd95f1e3fbea
- SHA512 52eff6cf17b48f9b9288ae17d94326dcf9d16b305710e4f2cce3866b0c611bbac14a10395fd31dd94d86193c57b7dc6cc7ba30ac007bfaa868c34309d71430a6
- TLSH
  T1DE11C0867C631839C261DBDA8F5C40A2FC03801F89250DF1F05A65F95FE96EB369F198
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  START_BRIDGE.bat
- Size 123B
- SHA256 9f120cacc92b14fe0d3779955585686fdb6a6f66364f030a238010805616a96d
- MD5 36df7d46e58b6648395360a60ea5a8b1
- SHA1 521ad37250df4f0af21954964507834d85b908d7
- SHA512 e72e0225d410fa1b3a0fd09e9a6d044ef314f3cc7da1e09ddf35cb2faa703e450253680b1d6aae7319c2163e2aefbd60dddb781f23c4bd114ac0516c953fd318
- TLSH
  T1D4B09256D0A4101840360B680D8D20B5FE0E806BC0180D62F6E291EB4BEE40E3D53080
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  UNINSTALL_SERVICE.bat
- Size 253B
- SHA256 04cee57a2253b8f2425ae4d7a08c40c5616efccf127a1933406ccbc16520b132
- MD5 e4a92655ea9f977bc1619620aff086e5
- SHA1 66575fbbe2a34eaba9869a4d7269e8cbcc56c588
- SHA512 089f9655200ee98ef930b0ae0695a2925d5747dd095fa58dfd941be31a07fa794c5ed5c085d9e00459278c0a08c40c6047c04c082f0f7fd620de191b0e82f092
- TLSH
  T196D02B423ED62A70599144131D773859B959504B81059E00F7D650B62A86054F37D9B6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  bridge-launcher.js
- Size 4KB
- SHA256 c558cb7b085a585a845052210b05b7bc3637d11e2288a5dd84c768490ee2b402
- MD5 078809dafbfcfbf67e54f5d45fc45487
- SHA1 1dc906da8d6d5d3ad58a889294b7dc6853a0171a
- SHA512 860a19f380a409b1caf5994581fe5e7e34d7bc4dcf9323a5d0fe2a34c9d68a52a8788e9901a421bad5fca91499bb2cbad222c1b55a6db80c644abeb0ba631731
- SSDEEP 96:Z6RrKQ6NLv1vC2YpitsiIvOt/Xs65FxyBIFBHvvcbZWUqr5:66NLNK2nVX//wwlvyEr5
- TLSH
  T1DA91868828F65839457762DD4B1B4827771E85077229CAB0FFAC92832FC912C87775AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  daemon\restxqrprinterbridge.exe
- Size 58KB
- SHA256 5859b114d96800a2b98ef9d19eaa573a786a422dad324547ef25be181389df01
- MD5 e0eef2861571b63a45ee59d802ccfa8c
- SHA1 f6fd98de7e17971be2a8eec4aa89e70bb26d1b7e
- SHA512 10164a85ac67e7b481be5f0abe7734dd27252fdd7ecb7855423cae230cc1c54ce8652e85f2571050ccfd50975a2c53db74185031b551ef2c46ceba8b4cef0553
- SSDEEP 768:dbLoXR9wSKYrHLHYrvL7yUUeUdfKTwEsWQFNMDmtUG0pb4Pe:dAXR9wSK6b8j2UUNCTSWQFsGwb4Pe
- TLSH
  T1D4434B45A7FC8676FAFE07FCB87101150671BA4B193AEB5D5DC090AE1CB6BC086217A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  node_modules\.bin\mime
- Size 371B
- SHA256 394b93eaaac25f18a20d7cdd80920ecca1fe43c8e5b37501389e644944c6e01f
- MD5 7ab5bfff58b0a878a4614cddbe424702
- SHA1 e75ad406ef2f9fcb1a9bde44ba669f416c824c4f
- SHA512 36f59fb7f2a1f985210ce39fb90e6e7998e4ba8030f172496eda22a12c66b58c651211d0f682c2b0ec58a6e1ae19d59380d1fe0c6849f15fcf381df60123aaeb
- TLSH
  T19AE0D87114A15F76910942F9DD155858415A1347B4043F95FD0C3B435BA031DB2E7B2D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  node_modules\.bin\mime.cmd
- Size 316B
- SHA256 cd5ca2f059e780c0a4b1aa9cdd6edc7dc10413d30bf51ad537adbd428e5e7a16
- MD5 2872347ac99221152281bfd56705d437
- SHA1 83fa66cd05f64de1ef7f3010344a0f7babe54819
- SHA512 3c0b9e12bc1ff8f2bbaa5301d8db78a5c3636dd93f5755728e5b255c4250c0ea9e3c53a545011087b9c2536b1c1676ff01f7eff3015e6e99f2e12c9f15386fe5
- TLSH
  T196E07D76F00070453237DB729417264226F2B748844301B6B83804FB6B413865FCE89D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  node_modules\.bin\mime.ps1
- Size 769B
- SHA256 a43d8b7d57dbbb21f2f98c331970d011177fa1c6be327aa0dbb84c1ad01e9201
- MD5 bef04abf08e89532a476c3e474b5f509
- SHA1 bb81073d8e07c483ee29121358871535973336e7
- SHA512 e20f86c40ce523477da136cb4aa3f29683dee567a31ebfad666666192417f49568e848cb8844e8dcd32d5501fb7176d47aca54c195324e6d41e73093699788b1
- TLSH
  T17301FE2479F03EABD3069B9367795E016245D66F24441F15E4083F8347A072C67E7B71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  node_modules\accepts\README.md
- Size 4KB
- SHA256 c25a1071e5aa1b1b43e10f083e8d97c3dbf1f7700cfa38b5cbc40725662e1ae0
- MD5 873e624d40d23cf9b54f9d2f74d2c8d1
- SHA1 3a884510d2eeed73a4cd5ae0947a6c72cd3c7426
- SHA512 a929edeb59edc6f1ef4f7554ddfd0b1b54aa097d4fdf69c5ec25b14c3c722a034d159daf3ad38508efc775fdf8c246507d53021e4ad79f0708c5df94b311a864
- SSDEEP 48:ZdC9AIvI6RZK0nwuBGWxGWwsNdXMoNjP601Wrk0aN8F07DaN89JC7aN8fBfuRhpL:/CnQl0JZ15jue/9IQxokXjwiA0
- TLSH
  T1F08174E323C556F76B03166FAD8FB798E325C42E91369890F1AC856C36C5A29C1732C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  node_modules\accepts\index.js
- Size 5KB
- SHA256 be2decbd50610e8f995c1e312ee4dd6d7c1244cfdf03ee4c4a3da68e572dada1
- MD5 4fe4d2c90a2fd19d6e97443a7d24f815
- SHA1 282263f45f6bf80fbf43f4097d53b5b60ff1a05f
- SHA512 c795b7285cc92616a46fd1ad2d00ce65fb4b269e6b6fc35315891d119b7c25b7f4573540be0627d577123201d9cfe119c8a53f0e75a8b6ea870f8d89a130c213
- SSDEEP 96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9
- TLSH
  T108B1328535DAB096974310B09ECFE749F035840B312BECA1F19D73B42FD1EAA8255EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  node_modules\ansi-regex\index.js
- Size 350B
- SHA256 c92312790eb1f246b7c4c1fe9c1247b15441bbca3c6cb64d167beefc45302753
- MD5 7d1a59d7267eef993b9827ee185500ab
- SHA1 9305ae17262f6e11f8afd69835907716ba5c8ee0
- SHA512 d1bd977b33603f9d06d947bfe108c1945cc2cd4575cd39eb84a20f15876a7dffc59c3b52c92af3b6483c1bb426983bfcc0c00faffe32821a5bdb0bd7d38a0484
- TLSH
  T134E068094851165D94D1708B2D614C748B89BF142DB28202C234EE4D5B4908F13E862E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  node_modules\ansi-styles\index.js
- Size 4KB
- SHA256 d3f197d370760ddd8753c1355b4bdb585a787f1baa92bb8ed217f170c138b594
- MD5 9d4acb14d5449b232b22bfe40453b00c
- SHA1 5f96df8b074e4854c03db87ef309eb6c741f4618
- SHA512 34ddb9208914ac53ed7c0e7162f74d0313a8f348f34db824414028313c03de674995ac98bbf856f5219d44d1af1455fa41678eb14dbc4639567b9227ef11ca31
- SSDEEP 96:gojeeng/nq55QwQIiZz5x36AYWND6brk1k+c6hj+pz/1nd3VOaGcAGTAG2sqPIdi:Weg/q5NQIiZ91dNWbr8k+c6qnRVOaMlR
- TLSH
  T1DB818806DB6DBE268696728F8C0CB817CF2C59947932C1BDBCF8973C165013F81A4E82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32