eaa2705f2a1443208de13fd33f45efd51e65fd376f2b7c6c86ad7ce83fcd0199

Sharing

Copy URL Twitter E-mail

General

Target
Go-Live-Setup-1.0.2.exe
Size 91.6MB
Sample260916-2xa9mstybt
SHA256 eaa2705f2a1443208de13fd33f45efd51e65fd376f2b7c6c86ad7ce83fcd0199
MD5 7af4669f827ec67ef04fa2842883d0b8
SHA1 7ee1cdc9d940863370ad805d38ca570d6261a66f
SHA512 6b49981d680cc773a932017b186ed9fc5d2cc49eda88678d29494d0efe51459003d28f7cd418ae28313354dc103f976eaa626921f440b25b9ffa3920fab10261
SSDEEP 1572864:DKAuEstwfGit65jHFqCg3b1arQR+023wbwzCP01+c1VsldCcGkeDxixHPXm:DKAuEsQGHjHWb1arn02AbXP01+cUlEJJ
TLSH
T18B28338F58212019C3DA5EBA49FBA2B2244EF1E6955CB31FE1D994D130C58F579FC283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Go-Live-Setup-1.0.2.exe
- Size 91.6MB
- SHA256 eaa2705f2a1443208de13fd33f45efd51e65fd376f2b7c6c86ad7ce83fcd0199
- MD5 7af4669f827ec67ef04fa2842883d0b8
- SHA1 7ee1cdc9d940863370ad805d38ca570d6261a66f
- SHA512 6b49981d680cc773a932017b186ed9fc5d2cc49eda88678d29494d0efe51459003d28f7cd418ae28313354dc103f976eaa626921f440b25b9ffa3920fab10261
- SSDEEP 1572864:DKAuEstwfGit65jHFqCg3b1arQR+023wbwzCP01+c1VsldCcGkeDxixHPXm:DKAuEsQGHjHWb1arn02AbXP01+cUlEJJ
- TLSH
  T18B28338F58212019C3DA5EBA49FBA2B2244EF1E6955CB31FE1D994D130C58F579FC283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Go Live.exe
- Size 200.4MB
- SHA256 f38b3161ec55dfb28f791ae4c999ab6a245f5f706a81e4a820050098c6fca43c
- MD5 0783ddd4a96dd0cbcd26d90a3026670c
- SHA1 497667fe3b0488392308fa0325ef5f79c47b3a49
- SHA512 1c0083afe2099b2810c9c73c6c9d562a31cd85a04d6f0ac9e1d51d1cf53f106f24751e214ed25b6d3378530dfeda9058ccd759a1e65c0aaf48acebc01dee89e8
- SSDEEP 1572864:0ir3YkVksSEZWaMZDjL3r2sHCDTnq/jxOiuYSeh019IZQEKzVn7SfK4lJroH26Pq:VIAnVb+/jVSbxkg
- TLSH
  T1FCA88B13E29601D9E05DD1758B5A9633FEB2B80A4B24A3DF2B5407522F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral11
- Target
  LICENSES.chromium.html
- Size 14.5MB
- SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
- MD5 b5e57572cfb5efa08f55f46772a42ded
- SHA1 51db84dada057af72e2fb8acca3ee4436e4bd3ed
- SHA512 288bcbf48f928866a0d2910fe57cfbc040f23b533bbdf4ef6fa43631edf6035d689ea41643b3afe833cb7476ecb2fbb932f137f3734df8462898c4837f6096eb
- SSDEEP 24576:6eBHJjZ6vobjZ6Mt3jK6DCHwR2auHxKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61J:6er8aeUSn8mMRx5
- TLSH
  T184E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.7MB
- SHA256 d8a6ff71c310c934cc859e3e9b1a2c34b0f38253bdc258c1476cbd9ccb633e37
- MD5 da07043f07a01969dc66b66e2c9021c6
- SHA1 84f4012019684aeeee29355f64d2bbec6ce47d41
- SHA512 aff96ee5a79b0156677938f8e01495fe1c37f92bf272c33ecfc5c889226d94ecc0be007f76440f05084874a5c4c42549fa6825f9865da50da942d7e6639ae959
- SSDEEP 393216:epLjH68inXc/GE+HiCt+2xwuQbgjvMCWT:yHiEFapwuNW
- TLSH
  T1684719122646D49DF059C878C3678716CA6C34EB3FA678EBC0B461152B7BEBC1B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
- MD5 360c2ec3a4114840498e4b0f45820395
- SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
- SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
- SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
- TLSH
  T185657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 5c8c4804c266b3c0bd1517c42f9dd310c3733fc14c363fc151306166295af238
- MD5 2c834f16e319c48813a7366cc42d9c62
- SHA1 8caa32bbda1278f7e9c01fd4319a2af7fb3701ec
- SHA512 1b54edad363360ef99968ed2f38ecce0dbac5da8ffe265797719832e2245b17fe5f4f696cf5430fa42338c4e4d2a5b921e76b9cc8c6130bf8d1d98f36441ff65
- SSDEEP 49152:BP7qY4ctjNE3KrfHEh1UBi0L//+eKVmQbJhvTxDUG5t9xi2QMJxUVlEQj0Ey4oB4:BThPD41Uge//WPd5t9xi2QMJxUVlEQjz
- TLSH
  T101E59E03F6D650DDD029D57097AB9313F631340A8B205AEF268089253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libEGL.dll
- Size 492KB
- SHA256 09dc89e7a401f272d29ef445f1825f4ef4422c6844892a6d8a56108b47a69504
- MD5 e795c02f5692460c2ac566d5d53972bd
- SHA1 80bafe27b2af747e768ab36cf7fa5c1f072ca530
- SHA512 400478284147691a25a6eebbcff4726dffceb4e7ef4e5a77ee170cc9fa1c3831d11138dac091266c017d2c4c65f93fd5141066839e80b05e001ea6b21f2d883d
- SSDEEP 6144:FUfgtSXLx7WDlUD3ntOb5EkMNvutTutO8PcRWLMJ85IeVeRAKx/b0:eZ7olUBObyNkutO8PcRW8mIegzb0
- TLSH
  T17DB49E15F3E545A9E07AC1388A434602DB76B8560B65FAEF03E093792F37BE45B3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 e5d96fb54dfbbf676b0b37c7915bcd907ff28f2ba63b49a72736a43ba3939a4e
- MD5 e83cfc0b54e74499d3aece7ecd449edc
- SHA1 cd18a077a977912fc16f6f9d77477bc1291b9b5e
- SHA512 22f00196d2905d50f62636e6c628efacec3cfba69981769cbf44806fee5c0bdc07b0c593cb0177ff94433eade1a7410298dcfd5a074abaf0f76fe256e0902104
- SSDEEP 98304:tsGAgRCWeWU4Wvy0jgjZQegl99ZmD3w4r/KlX26M:S+ervqggMqgUKpN
- TLSH
  T17B868C03F29640DDD05DE2B897579227FA34B8450734B2CF2A9457252F67BE0AB3EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  resources/app.asar
- Size 2.1MB
- SHA256 f1284620826d9b9b3d25fd1e890e18d6e9363aa6a711deb0eb137bf0029d72db
- MD5 83f1e40067c510132e4ef442e08b8cb6
- SHA1 c73f8c8fb755d0333fa20c5ebcc14139a9738442
- SHA512 6beeb5344e5b668958db132da48b64414b153166be35f6ef8fc346306a597b1f92fc8cdb63da1aed73148ebc33ab305aeacf4a1f285e740e7f7da0f6ecc38ab2
- SSDEEP 49152:HSKu4C7AQGdhzKxDsK8csVGzL98cdYFvhUcxJsIpZuK8:FdhmwcIhUQXuP
- TLSH
  T158A5E86515E7A635666323FE294F0096BF34F447A104D500385C9269AF82F38F2FBAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  resources/golive-audiocap.exe
- Size 198KB
- SHA256 bc8665a83dff3217e7e81d126078a7e19e6024adf49ffbf6677142a94d3f7b4b
- MD5 403e6c5d33fa4fc73a534a9406bfbdbb
- SHA1 9a05ce3bf6f5adc627f16c6afa97a90e23e64da6
- SHA512 50af017c066acec074d706d7aab2f7a51c6b11f2f7a41bfedcc393174b1d8664287c3ebd03b4fdac68f8dde0108f74e0458641a2c362c14b28d87d69b04e8686
- SSDEEP 3072:qh3m4rWn82rg9SUH+KEKPt8n9n5OvG2vgwChOqVLRe91rsI1vAo:qh3d2FG+J+t8GvdQhOYej1vA
- TLSH
  T176147E15F7A510FAE2778538C9524A02FB727C5647A0AADF13900BF69E237D09E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
- MD5 57ed221051a5124546848d413c7bf534
- SHA1 37fa025e93d7fbeb3a6eeb21660221a35b3bc917
- SHA512 c9ce057dd2f166cf75b2d4a4d8a6ef90376cba15ad182708ba24504cc7ee11f7937feb5414a874df573a1aa7e51c23e257e611300725315a11de6f34fef3fc09
- SSDEEP 49152:ljso2Wp9s18LbsQCgJxAhgK4axTciCuE2aRj6q8U45uqPppkBXqyWwBgVGdWyKQS:ljd2WpM99ZKtA8h8AHwv
- TLSH
  T1E7462703F28680E9F05DD679875BA622F632F8814B2276DF56A01F192E77FE06739704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
- MD5 84ad45974c4d28380280efe0c25137c9
- SHA1 0b6740c39c53fcfcd98c0e82bc3878ff0371d2dc
- SHA512 0c0d7454cdd38146e9ee7bf296bde8fb368e3131a6da9b204bd4b02025de1cf9a44085c5f6741159f39f82284d7dcbb9078389bd9960d9d9da08b3b7ff2b5ceb
- SSDEEP 24576:FgQmQinxRotX321+hvdK2S6Z5WGcSDYsHQDi6g3P0zAk79oOHHe:+N5nfotX32qFKb6Z5WGcSDYsHQDi6g3L
- TLSH
  T1DF155B1396958569D57AD038CDD28607C9B178822326B9CF02A817087F6FFF47B3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32