08c6986cdd29d5430492282adb339b30b1c1f11c5ed6ff3de8fc5add42b6da92

Sharing

Copy URL Twitter E-mail

General

Target
Dhalia-Techdom.exe
Size 132.6MB
Sample260913-wcsejattcv
SHA256 08c6986cdd29d5430492282adb339b30b1c1f11c5ed6ff3de8fc5add42b6da92
MD5 24a8a51006e2a2b5324f8553b9cfb414
SHA1 e748f46f960019658a294cef69a8dd6690d75d96
SHA512 df8b8fd6a2cb9c51af03c8000f346ab95f75cfc1fd2bccfaca69e56ace7bc458e2f65028195b65259d2c42de1e82711c22b5636400e9223ff53d29c70d7e8d9e
SSDEEP 3145728:c2lhgsl2RN8AYZzF2RhP52j93du33B3Y56C5PxeF7:6ujZzUvh2pdAxo56C5PxeN
TLSH
T1D76833068BA540ECCC8A1F31CBAA033865F332D1B929C17B7DB97D55BA707ADED80651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Dhalia-Techdom.exe
- Size 132.6MB
- SHA256 08c6986cdd29d5430492282adb339b30b1c1f11c5ed6ff3de8fc5add42b6da92
- MD5 24a8a51006e2a2b5324f8553b9cfb414
- SHA1 e748f46f960019658a294cef69a8dd6690d75d96
- SHA512 df8b8fd6a2cb9c51af03c8000f346ab95f75cfc1fd2bccfaca69e56ace7bc458e2f65028195b65259d2c42de1e82711c22b5636400e9223ff53d29c70d7e8d9e
- SSDEEP 3145728:c2lhgsl2RN8AYZzF2RhP52j93du33B3Y56C5PxeF7:6ujZzUvh2pdAxo56C5PxeN
- TLSH
  T1D76833068BA540ECCC8A1F31CBAA033865F332D1B929C17B7DB97D55BA707ADED80651
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  GoddessTerminal.exe
- Size 168.4MB
- SHA256 86e71e9e457bf68412b9f44e2d9ee7cfd6e6fe7d1848e7a876fa695818b8c353
- MD5 65b5366430046e1bdfd023893bc32ec7
- SHA1 cfdaf7157ceb9919d485311391082193b1c21e1d
- SHA512 35aefe9c821358a9b2329099751e8280f162259b352a9e0da060dbf2f155267a4ef5443a36f5be1c171f616f16c7be2b24fa0d0908b98479b73224f34ab5dbeb
- SSDEEP 1572864:egRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:Kg/geeFXzGa9Fz
- TLSH
  T12B887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH
  T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
- MD5 8f3d89744ae11b0925faf4b64890d0d7
- SHA1 6a8f744be1f76e9ad28287d969d8d24f5f1e7623
- SHA512 250c06e70276c08d3d8a63744af6c570b6288e1d8fed8deed915c79bf0a80c3cd0a7e64c55a16fcbc50ccbcbc9910b26f87983ceeea8ed28a75c1b8ec22db53f
- SSDEEP 49152:G9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:upKNMo8rBYinp/FFJM
- TLSH
  T138D5AE06E6DA40DDD019C1348A9F9223F63139468B24A7DF1B819A253F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
- MD5 f1fe23058e7eece1de389a0c882bc1ad
- SHA1 e83b15d2bbcb6fb2867651a2a9797ed3b6827947
- SHA512 d7d51fcb05542fa81e871dd9f1dd960c363107d1c25311dcbf81e440d1275054c121a788def8dbae47c129e95fd990042e2d39e6ef2bdfb253a114146eb33973
- SSDEEP 3072:0Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0+:qbTcZ6+lOP9rmD7QMYYtaFy951wj5ze
- TLSH
  T1A1A48C1577E444A9E07BD474CA534642DA76B8920F24FBDF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
- MD5 76141455cd2705897d38e9785117e405
- SHA1 ee091646b6273bf006cfcd84fd54384b0a9d0e0f
- SHA512 551b79aaffdc469448477aa72554458235f118559eecc567c232599a4193b2639c14eafacad533485089af58701aeabee690b43f36e41342f928d4973efc02e1
- SSDEEP 98304:9x8EI0RtffaYFH3lV5D3u31okx/6bXm3q:LhXfTFHmoKgCq
- TLSH
  T1F9767B03F29A40D9D05DD2B59B4B8123FA31B8855724B6DF266413253F7BBE0AB3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar
- Size 65.1MB
- SHA256 a9be8410ac1f83552941daae428bb6847d945cf48d85bba369eca852ff245a27
- MD5 e4d85243f1cb61697b96a701e311067a
- SHA1 5e20e27ee91b3d3992f41482a94676c0edc4d0f6
- SHA512 0b79440cbf96f637df0e429263f0b0bb29b76a85c057282d10f33ecc569ce705473c3c36b34f634a09e5915fe8cc4d2de00c9ced8d4506523042234b4a4d11ed
- SSDEEP 1572864:Rf7c9w398OmVW9bcYte1WkpJmcB6fyQyKLHK6lmxhhovA:t98OmWbcYkslu6f3q3BeA
- TLSH
  T1F7E73316576080ACD895273846E64330F3F3F3A1B81A874BBDF569797EB0BC9AD526C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/index.js
- Size 436B
- SHA256 3719d42460e51b010591e2b8cefa5b1c2fba8aaef4087409bca1cfc316afedab
- MD5 52b00065161497aca81759e89a3b3b15
- SHA1 b20c959598fd001bfed153daa8bedcd839119da5
- SHA512 cfb7408c090429e1e910ef75baa13c251e67cf28311fd8bc84f6a59a926124e0005101a533821e05f4fc86a3f3b03d676014097a0719aee2d4ea237bd3e67f61
- TLSH
  T11AE05C57D5DD4D608EA03FF13B4A1D2B02E472C03F046259884472AC57A405F4C708A9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/source/linux/background-managers/awww.js
- Size 675B
- SHA256 85a32706a7e0e9e308fb24d0432cc99dbcc1dc7be46677b9a203233dd35e105c
- MD5 8acf3d570845ad85ce78bc278f53a618
- SHA1 d24e6f6294389155d75b035087b7ee22c1cd3733
- SHA512 60b5c0c7b68f9d0ee1ce0f08a1b7b6165bb1b812ac0f77f67f42d65b95dc6e815d6c70c1415c4bb95282490ea82f0c4cf012428f9039e1509b69a272d32fd3f2
- TLSH
  T1C2012319B2FB0673C2B97014D43EB0D9021ECB4C2F8C4A56292D0DF255BA06C6D32CF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/source/linux/background-managers/cinnamon.js
- Size 680B
- SHA256 8c8b89b999aebf15534537d74fb645e7457719e177d38264adbe566b46c84ccd
- MD5 5bf4e13b06716bec2ff3c54dd8119aa1
- SHA1 39e2f8c1143b5879320223c3c304a8572186e891
- SHA512 afe38231cd0b8c970f58b82581a384e07b95c41585c958b0c673c8cb6e02ba1e20d2b5c9d7ad2ad4993ba53cb23711c579cfbd7a04cf9bef4a89567aef7348f2
- TLSH
  T1A2019ED687EA52BA93312210EB3F1153925DEB418C78C2B3B2BE28D0346DD184D71CF0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/source/linux/background-managers/dconf.js
- Size 461B
- SHA256 1bc193d0b8fa199e0a219acf14c6948436f60ca99d2bddc256f71f67db3b7c76
- MD5 812f49a1ff382fd826aca8848414b5d6
- SHA1 b4f1c43e55568ff1bd13d705bea5ba5bf570fe17
- SHA512 cbabe952ee4f66aba5d1c4e57ff832bbfce785e4f024e0142b69c95d8c5a0c5062950d14f638d3f1c7367a399235226301359747f5ae9256d2ae631c76395e41
- TLSH
  T138F05C0E11987A93D3E63030EE2F99C4521A93405CE1C64311FD3CF5665751C9C71CF4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/source/linux/background-managers/dcop.js
- Size 271B
- SHA256 44a3ff53e0aa72531551bcf9067cffcf37128fc1ff1ccd23e7a52bb2ee91ad26
- MD5 ab33fae618d24ce840aeefa53fef75c0
- SHA1 100e1e74d81cdbd905da07dbb0e8bedcdc35bf8a
- SHA512 87fe31e73ba8b2ce2ef30a5ce84ece9b11e036f038eac2e423d55c01d8c64f1c10a863b1b634b13af6a94614d3d236803cbf034f758c2f3ad2cc7442265872a1
- TLSH
  T166D0951B125929D1D6B47070DD0FC99B411E4BC40E30D14341BD3DD66D3701C4CB1EB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/source/linux/background-managers/feh.js
- Size 215B
- SHA256 b50ae7161af7d58e3b04846cc5a3f6cdbfee56bd42c45a41c55e9e32eea11ca8
- MD5 3a14fc919ed529fd94e2276fa6078640
- SHA1 14480b78428eb356e2a639d367f1cc7c1c12718d
- SHA512 47caeba03f41f0e4a0b66092f2752d267f6c05e22bdb34748b29f18e804e4089b768fce3dbd290d7e30500c70a842b5dfa089f97c0aea73bc14c030c11146c1c
- TLSH
  T179D0221B26AA23E2C2EA3090E94F8ED6039DC3840D94C293822D6EC2A9B702C5C70C74
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/wallpaper/source/linux/background-managers/gconftool-2.js
- Size 307B
- SHA256 4c0682d2f17e82c5f4305cab2256788ddc8a74ea2b7aa6543f60b412f29c7618
- MD5 f3ac81d28afbd88997385f4a2ae2b007
- SHA1 82d3fecef4484fbe6225bd083871cfd866bc0b69
- SHA512 7e1a75f20df503ce76b127cd259f5f5830d46ae442aa710010d87262bac85c5616e3db12fe23723efb3e5a4e255d91bc91147f732f703ebfce0761b915d476c1
- TLSH
  T1F8E07D1A019825D3D29930B4E53F55C4451CC3C42C349953111C9DE7AB3E0085C31C74
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Hide Artifacts: Hidden Window

Sets desktop wallpaper using registry

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Hide Artifacts: Hidden Window

Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32