fc4ff591f4df0d71c929c994dd166070f734e606f08dc4b85c9bec63730de44c

Sharing

Copy URL Twitter E-mail

General

Target
Modbot-Setup.exe
Size 107.8MB
Sample260916-twld8a1wbx
SHA256 fc4ff591f4df0d71c929c994dd166070f734e606f08dc4b85c9bec63730de44c
MD5 cdf3d68a9d82818da284fe4a3ba8ac57
SHA1 bc043dfcd15262561caf457a4295170fd8b3a130
SHA512 c30b4c538bf856d4bc86b3edd8ef1358fdb44536fe60a8a2fb00a37fdd82921b427e31b7f796296f29fcf2ea256256eff3d29b67b9dff707646e488d086e4455
SSDEEP 3145728:X6XLI8iTnIdr5okO6OIqhPX9tX7J/4TlOysy0gapC:g9Kwr5oHIsNtLJCzsy0gapC
TLSH
T181483397DBDFD8D6F251ED32BDC91A611D08178958F831E3288AD8AB31B1EDB2473502
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Modbot-Setup.exe
- Size 107.8MB
- SHA256 fc4ff591f4df0d71c929c994dd166070f734e606f08dc4b85c9bec63730de44c
- MD5 cdf3d68a9d82818da284fe4a3ba8ac57
- SHA1 bc043dfcd15262561caf457a4295170fd8b3a130
- SHA512 c30b4c538bf856d4bc86b3edd8ef1358fdb44536fe60a8a2fb00a37fdd82921b427e31b7f796296f29fcf2ea256256eff3d29b67b9dff707646e488d086e4455
- SSDEEP 3145728:X6XLI8iTnIdr5okO6OIqhPX9tX7J/4TlOysy0gapC:g9Kwr5oHIsNtLJCzsy0gapC
- TLSH
  T181483397DBDFD8D6F251ED32BDC91A611D08178958F831E3288AD8AB31B1EDB2473502
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 107.2MB
- SHA256 812c65d03b58d6c5737bc34233d1fa92648cb0e6f1d8d505f6227082b6fa1494
- MD5 6d9cb6f1083744a302d5a844136e8c9b
- SHA1 ac539fcd0e09cc301d975ce7fe1bfe7a52f65f20
- SHA512 2fda222c33b84198a884cc540733c35cf01e3d3538311e40e3e5fda60807cae94c689754a68801c08c0dc91fb4dcc8c5e4359fe774ef3307b1885695fc146c5d
- SSDEEP 3145728:TXLI8iTnIdr5okO6OIqhPX9tX7J/4TlOysy0gapo:H9Kwr5oHIsNtLJCzsy0gapo
- TLSH
  T176383397EBDFD8D6E211A976BDCD1A215D08078958FC31E3289AD8BB2171EDB2473403
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7
- Target
  Modbot.exe
- Size 224.3MB
- SHA256 37f5d06172400bb1e4bef74872effa6a6b5727602e96201c8c1f818f46fe1784
- MD5 c04e4eba5c5d5e2b5f95d368f56cfea4
- SHA1 b4e2ac060a7d6de6f67ba59a323440553f3c4255
- SHA512 53567239a1470e209af0ad2683f969a952a7fe5ceaf0df159d5be37dd53bbd970c9d8cc763cf196acb9dfa66e9677ff52425ef1d080a62b1fbe55bd3b6fe21b6
- SSDEEP 1572864:+R23X69kWjMC8gyZucJ2yIdXgWzL8kM/JKJUlIKzS8Vi8xs3zlc/jeuhwbMfhaWN:vn1C8lato8DzO
- TLSH
  T14FB88C03F29A41E9C01DD1B9875A9633FE71B8054B25A3DF2B5447922F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral8
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
- MD5 750913d55e87def9108e55728ba67d00
- SHA1 a5944bc170d1f6c3223195c043134566471dae1d
- SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
- SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
- TLSH
  T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
- MD5 d476c19d21b3c2861f08c1c82fffddcb
- SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
- SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
- SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 185da2d59b0655e51314175307794483edc5e3582659c3a7f2bc3ec15d7ca126
- MD5 e7d66bcb31fe661f8ac6571e8888bbdc
- SHA1 970944e472209d0effe2bc64fcb8d99ba18e1cb0
- SHA512 5cf9aca67c4d0c8d6bb09548a61fcac3460aaad2e4768dc6a1842664a2e6334df3fb2201031798cbf799809d446898bc63c804ba3ead2fc1b66a129967608221
- SSDEEP 393216:AfdGaDlSDfQI7HYkskwnQIhanlkjaDEu:qGf3zyP2D
- TLSH
  T11A473A122646D49DC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC1B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 90755f520cfcf4d814157bf2a016dfe4d1cc57ce777200df87d0791e64653fd3
- MD5 a832a2be5c3be79264ef6ae5c5285b1d
- SHA1 90c68dc9a6ee3463a717cc23588261e48ac44600
- SHA512 2c6c30bb8de463343974170265c1a7e2e81fe1e6609c08baee59c29d38a6f1d7aa7fe4d8d6ebe2e01cba555609630a738a3bd6f987362493fd9775e280e22b8b
- SSDEEP 49152:CNfhEhAZtlrINr6T6XF2i81IQbx6i1N2A0hGR9/HvaLu/wSvuMmi:C9ZtorhXFgLaLu/wSc
- TLSH
  T11FE5AE02F6D251EDD029C03497AFA213F271780A4F205AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  libEGL.dll
- Size 467KB
- SHA256 989d478398c08e6f742870d06c2ada99c5f2d93b958b345b1cc60238a12d8093
- MD5 06e7201b99c99fa27953fbb311ffde52
- SHA1 4c8a872c1311380656cacc64ee7573c8b19741e3
- SHA512 bd4b5c52ca123b844e268fd2bfc97f0e8009bb9c32dab813b9729b55beaac6fae2473da04aff0e612e54522b6e15c008ecc606f84046a875a9d9b20f91b7cea4
- SSDEEP 6144:21CA3wd3o+Ws+rphP5plnCqMTtgkcwhEKr089rUIMh8C106RUDn7v:2YMw++WHhDvMTtgkcyjrrrUIR006RUf
- TLSH
  T18DA47C15B3E948A9E07BC138CA538547EB71B4520B61F6DF02A0D2793F77BE46A3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 f507a35332883223db84d7a9323426fbe692420c2b8bccf87b45f1ee78025027
- MD5 40779a3555fbe544f8cc37e56c177ef5
- SHA1 139cc51897ce76657858e46d89fa41eba494d08f
- SHA512 26b07169b3d738a9b2816f39a800a7f1e7fe6bc8031716da077e857d9fe9e025e0d140f3e41e82257378a6399f0a026efd8cf8ddef5dfa083cb9f2b0a8874a22
- SSDEEP 49152:d75p3HRROBRUWekbBbdQOz84oA+Xqomv7OjIlOC+Tz9DUcukHrZMh+tROvn6qrqR:NBkPb94q7o9S8gvLqDZAlD6
- TLSH
  T101866B03F69681D9C05DD2788B67A223FB34B8450724B6CF2AA457152F6ABF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  locales/en-US.pak
- Size 558KB
- SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
- MD5 6249e6f03590c631a2a873b3e79058d4
- SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
- SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
- SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
- TLSH
  T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources.pak
- Size 6.6MB
- SHA256 b92a3508c9631066b013adb736684e63e7b9e82e5f4c8a005b243e8e6b2bb5d2
- MD5 d36dc817d163729acb7886ef14673881
- SHA1 cb7f36e1ba0f649bed5f4c34510eed1e0e2018bf
- SHA512 2e81faf0b555818ed61a4906226fae8a2d79f51216c67fece11bd9a6eaa7a784f88b333b6df1813d62c023874b49a8e8a9c1288ffda489c943b7c87a5cebb6ab
- SSDEEP 196608:plsBRHPfIXoDTz9uTjTMkriACmZnC3gEL34tVrW:8Tvr/ztkrDntEoVrW
- TLSH
  T16A6633D266E3A80BCE9063B98984CF39199CAF2572D4B093489D5119ED9CF5C0BC4B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/elevate.exe
- Size 113KB
- SHA256 0d8bfa6e9dbbf44290db4cb20b562277322564e27b35ca7d4fa90cbd559b2a61
- MD5 e3a31f0cc2fa0adeb37d064e7b654baa
- SHA1 65d35398cf368cdd628e1777c7fd422bbd593dc4
- SHA512 0642eb46272f236c0913f50d3c78cb1b3b257eee8f83b1cc774b48a5c85b883c2d8edac6dc3d4dfd93cea4b25a96fe42e7e26845c2d6272e38e6e592bfdd388f
- SSDEEP 3072:P6bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl7CBfn:iPrwRhte1XsE1lI/
- TLSH
  T14AB37C1178C0C471E5732A3559B4CA718E6DFD700E759EAB6398027A4F602D0AB3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  snapshot_blob.bin
- Size 338KB
- SHA256 c8df1c2c3f8088f915cb4b9a8b79536f5b07bc2e5f54e0423945996451672649
- MD5 133dd1713dc5d97770ee162ff28faac9
- SHA1 8daceb248882f68e73a6c586c2c67e6581dc2cd1
- SHA512 092ed65510a63466e5992e3579255cab286c5c479957f9dcacbc29d8cddaf88282a3c0123f9bc29975ebb3d98a76726044ee7624a0771ef9874b94aa4c5201f5
- SSDEEP 3072:juOiXK9Ot+xbRt2FJRCrUSKzL+byN/+SN4OLuVWP/zzvXU/P0cA/9:ju5Xzt+Hw8re6e/VN44T/nMP0Pl
- TLSH
  T11D74E012F709CA26C8B639745EF58B942E24B2CD9D89AF573060437DB4796640E2F38F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  v8_context_snapshot.bin
- Size 704KB
- SHA256 2c9ef5192e2b4cf28e3ed779005949cde8b4352a52d101e56e3373e1e36b1f1a
- MD5 6d76f4bf245da2e102abe886963b1b11
- SHA1 cd184d1b8cba6d8cd2232d396c85ac2bd35d7462
- SHA512 ceaa87203dac600899cb107198b2c806827ed0dfa956ef4b503e81677dc713c9f5fa234de4d669246bbda3cd2a37a4463e6d5a8025a30b980addf52d6cf83e66
- SSDEEP 12288:m15XWgMFDnh2NdOeP8POqYUdEMH+jURWYS:m1mFh4H8POqYkEMH+AtS
- TLSH
  T130E49676FB0ACE26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1A20D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 9b8cdc81cefa0f12e1ab357afc7fcd0aa00268e2256df15d3bd658a744e036e1
- MD5 a0416d519d3f30552de307739ccbf4cd
- SHA1 9588b3f5da20c6e379ad46e6d89edad9c4ed3094
- SHA512 22d81d2524d5eacd7ae06e0bf1bcec2b5509d0ffe9be65729c15ed46c2b370f99c4d64fd15a0495e53677239a81854c92c2b46b4f31d56296e79f3492c7157d2
- SSDEEP 49152:M2hL09htQ+ZkKLw9MdKpO/2cPqB4UtjXz0MbR7q9IKWEsgPjqXKch5HgAiFoTs+z:M2hLGpIBQqo+sGj
- TLSH
  T1B2464903F29681D9C06DD6B9875FA623F631F8800B2276DF56A00F192E66FE06B3D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vulkan-1.dll
- Size 904KB
- SHA256 1cfd8955e83b56947e659022b960aa2dbeec8c23539c3749db02231350402a4e
- MD5 b1cd4286e48a9ddc0e8a5631e0096456
- SHA1 9826cf05235bd0798ad169d4561c6327efddfc22
- SHA512 9b0b5994ce6a869cc70e89121bc3bb4d02f328336aa6687e939a6d012894fa494113564a03de347a29c6e2c6e4d9cd75196355725247996661492672899bd10d
- SSDEEP 24576:3NXazucqvgc/N292hPb86Z5WzcxDYsHkDE6g3P0zAk76oOHDJ9v:9qBqWchPA6Z5WzcxDYsHkDE6g3P0zAkO
- TLSH
  T126156D12D6548B69DA7AC074D8D18A0789F074851322BACF07B817147F6EFF42B7DB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $R0/Uninstall Modbot.exe
- Size 177KB
- SHA256 5300a0a391137160fc0e1e9b667ec3e07e50a06a458f89897a0c98285470965f
- MD5 87457c53c3134be69b0e3373a5ee3d8e
- SHA1 b7d49fae553b9238b3bfa07b8a68e5225a5e2ed9
- SHA512 7b5afb326232666cc4c6ee43e64936fb669caab99d629a570c640a3bb9036f856fd29a7d676de0da790638942bd88d91e4ffc0529c3d739ca9a1e81f04d9e8a6
- SSDEEP 3072:Wn77v00hEoDEtauF0GwbM4HroWEZWYaa12tvhOEA1RJCir86SrSrv+a39CBfF:W740IIrV052t0EyL+3a2d
- TLSH
  T13D04F116BBA4C463F4F75F3186B587D7AEB1F00038506F532B802A5E7996B8AED1C750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral27
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31