b117f8ca4988f030ecfa51a6942181a4e66f00b74287ab371a7cf04cca151c77

Sharing

Copy URL Twitter E-mail

General

Target
izabela-next-setup-1.0.0-alpha.49-win.exe
Size 123.8MB
Sample260919-kdbydsdb96
SHA256 b117f8ca4988f030ecfa51a6942181a4e66f00b74287ab371a7cf04cca151c77
MD5 56c66bc534f457d5ca975223b86b2c91
SHA1 4ecea22ad86b056ac7e753362cb71cc2ba2966e5
SHA512 fd7092c0cbdc52c76f80a935e31b0348a1fe1a72c48cd380067697b3018814d2e79e7641247e6987524e555d43ebcf217f0dfa61218446a057808a30fbfcab4f
SSDEEP 1572864:QVTczLHPZnlmujyGT/UAwU1C1YucG2ikZSZAT7c21MISg60jlmfzAVMf2jvVEMEL:QVwxiAoKrucG2iBCT71MT9kCUVEPWzW
TLSH
T16E58331BCA296326F8F83F3164B0DF341ADB1B15AD72042B4A94BBF9ADA58C143D57D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  izabela-next-setup-1.0.0-alpha.49-win.exe
- Size 123.8MB
- SHA256 b117f8ca4988f030ecfa51a6942181a4e66f00b74287ab371a7cf04cca151c77
- MD5 56c66bc534f457d5ca975223b86b2c91
- SHA1 4ecea22ad86b056ac7e753362cb71cc2ba2966e5
- SHA512 fd7092c0cbdc52c76f80a935e31b0348a1fe1a72c48cd380067697b3018814d2e79e7641247e6987524e555d43ebcf217f0dfa61218446a057808a30fbfcab4f
- SSDEEP 1572864:QVTczLHPZnlmujyGT/UAwU1C1YucG2ikZSZAT7c21MISg60jlmfzAVMf2jvVEMEL:QVwxiAoKrucG2iBCT71MT9kCUVEPWzW
- TLSH
  T16E58331BCA296326F8F83F3164B0DF341ADB1B15AD72042B4A94BBF9ADA58C143D57D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution persistence ransomware spyware stealer upx
- Renames multiple (87) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 123.3MB
- SHA256 94f86bedf8fbff4305505d424eaf7c72070f91a547062eca09ecd4c1defe5271
- MD5 f086e88c6abfa30aad52cc98ca884ee2
- SHA1 046ff8c4745e8b2c8e5072e79bb2998e40ba3b24
- SHA512 3d2149c5da843b1f449210e19a915f74473c091c54544aab86e0a03b5c097f43b818091c69f93c383c4c0f1c51705f69525157580b55eff31b601d92d4cb0001
- SSDEEP 1572864:vTczLHPZnlmujyGT/UAwU1C1YucG2ikZSZAT7c21MISg60jlmfzAVMf2jvVEME48:vwxiAoKrucG2iBCT71MT9kCUVEPWzq
- TLSH
  T12658335BCA1D632678F83A3164F0DE301ADB1B16BD72042B4AA4FBF9ADA58C143D57D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/@nut-tree-fork/nut-js/dist/lib/window.function.js.map
- Size 786B
- SHA256 cc8c88dd41750d4c0f857d35218c34a56667641ba99841a18574383044448bbd
- MD5 e5d02fcb94664eac38a6636257410ca7
- SHA1 cf1e8785bd9aa4516069479e6eb4fc4130b0b600
- SHA512 b7aaabd6168295ae7e6dd97b24fa49cefc1b58ef6f2726b66f6712304c41484444a0034937215a74e03c473c3e58c9e8887703c313cb38be23457a22013af03f
- TLSH
  T19001BC1214B2E91BB953079B28CF96827E20185C7CE87B0149C8DB21F0D5F3B7CDA8B9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/@nut-tree-fork/provider-interfaces/dist/lib/clipboard-provider.interface.js.map
- Size 151B
- SHA256 80a9b32994ca8a925064691726b80cd694be74eb1f582c97663a1ccca689493b
- MD5 b29e34f8edb217c78cc3c2ccbafa1f39
- SHA1 7dab4bf36103dffa792c2b338b0066c63313f417
- SHA512 8875b8e4ec948efe4160a9f7964d74ef2c9196c3e068138c194ce4aab7cacc35acc9f3b078afed24c67356019c9fc0142b39d5deaaacb0793347eff0845918af
- TLSH
  T1FAC08C0248393E3089000F600C470E6353C809002C8C010CC882C92051AA88E48CA94A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/@nut-tree-fork/provider-interfaces/dist/lib/element-inspection-provider.interface.js.map
- Size 169B
- SHA256 8cb22adb744216f70d80750ba9c409da42e2c29a76bea6e07ea35a1c0df5e362
- MD5 75075688e7a7b7122764da97c9c178f4
- SHA1 ec88fe4e05c2ba4b94d6e87d32da845bc801a171
- SHA512 44a169e1f94232866acc9bece47c74cc4e335d6616dbe7739ea22c214d96eb720bcf5f347adc129266b569497ea79c482e04c35cdc73e4cec1e8d5dca8b6cff5
- TLSH
  T146C08C8269313E3009068A7118475E6293EC4D489C8C826CC0B2C420D9FAC8A4E8784B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/@nut-tree-fork/provider-interfaces/dist/lib/mouse-provider.interface.js.map
- Size 143B
- SHA256 68d22010161abb817ac4d527a74ff24b5243f83a4d190984b8aa74f13638af1c
- MD5 5deb10b1cd7338c0d0b911f8b3494bbc
- SHA1 04b79aad8173da20dbe9681145c8dfb0954032ab
- SHA512 0ed83aa2c5f7240b331ccff96b507840031f26e1a8dc9e5e8c0bccfa0e16326600c83e4c163d55ff9db18c91a0c0d02b16fc67929a03c39994d215ee28eddb5d
- TLSH
  T177C09B578C353D311D415BA41CC52F6373DC1D05558D174CC4A7C4715177C9E49C594A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/test/buffer.h
- Size 519B
- SHA256 3cc041044da442c68125d773c288c19e3288a8485bd05a19d988f70ce6bdd500
- MD5 8f2103635b0acfaa4bf9377c1bc52d75
- SHA1 1fd3ad970d1eaa4dde633f84101cbabba1d5f184
- SHA512 3562eecb4f5f772bdea1de1e884e29e78a54cbbb83a1b71dcf51ab3b70ef69a86a0fd2051a9d2ab4f56ef52f49c8d21f77e693777b5a1f2a7822c25b8fd1a4f1
- TLSH
  T1D6F0C95029DEF0082BEB75B0A2089424B440D63C27786F02D3DD0A31BF01E3570F62C2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/test/buffer_new_or_copy-inl.h
- Size 1KB
- SHA256 81e27bee6f8ae550a7ab9037bf054aeef7406619a8adeabb5c5939b11df08be9
- MD5 5247b1bfabed1062492c26a758966cfd
- SHA1 40324252da44e8169c21b2cd3cc2472dff9a8dd7
- SHA512 9920cf20e2a9962bc6c7c334afea5bf83e93c83873cb92558551b7c71ab7f0d332f15dd2ca870ee231da985f56cbbe8a575cb3b29dbf3741f8003b26e6013dbd
- TLSH
  T1E6315B02AFA241121453F05325BFD9BEA515EC2E6A89DD11B0CD2E206F54EB8F5F46C5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/test/common/test_helper.h
- Size 1KB
- SHA256 8dbdc734e9573c4ce37ca1212cb24d695c4789dbf174c4f11bb0e5a3e28547d9
- MD5 2397309ed70e8fb6706c5fd07bc5b8d6
- SHA1 ae828609fc118a2f6966f427c327bbeba8723238
- SHA512 c1be11d6a5356361d179979d73f80debaaa14d77d64fe78f5bd7158cf49a3c600c7c18715263e6e0a75a650cf33e70c86abf6f6c5052ea8e15cf491230fe1196
- TLSH
  T11241D1712F6AF2D01377D474900ED3978B29D59F0F1922A784DCFC6CD802013627AEA5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/tools/README.md
- Size 3KB
- SHA256 65e9ea918538f453166b10a1d609cf44cec3d2d01f23fecb5265fb3a4bf303d5
- MD5 34143c24d232ac62205ec0b7601cb109
- SHA1 3decbdeed6f0c742925a5be9b78f5251a4c0b569
- SHA512 07dad1d9c5c618afc5fe2b8183ea40db0cd736e0600ba8bde4f38db726d85e277c460140ef312c91a748a208ffa72283be01a224f976f3421f144a2977ea4b2f
- TLSH
  T17561920EB7B0E1E508B740E1653F449AEB40809D9B00BC6494BDC5AD2B46B7B833B2D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-api-headers/CODE_OF_CONDUCT.md
- Size 159B
- SHA256 4c771222bb82f2bd7d2b1b78a29e97b62244d198c065a815ff2c49f59c14fe84
- MD5 80d44d5d4adcf57984365ffe00994b5e
- SHA1 ede7ee4913f31d530c9402fe555d00f961d1f416
- SHA512 1cdb36216fc7deca133cf6cd9fa7f4b0316c7dd3b6dab858f0bfe46f34a1be3e702c91e4e6a8c293b73cd6b177645fcf0de60acd1e11f0dc1ff0a967246c7720
- TLSH
  T16EC08C2B02C923D89A4020DC5A6AA0E8D0B90A9CECC2C27041817868115082317DE0AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-api-headers/CONTRIBUTING.md
- Size 1KB
- SHA256 2ad4bf62c8a9e29e6633266790e6c6d43e3a50ffa6385199872aed4281411817
- MD5 e7c96c2f22f829b62b0984a86bb04e3a
- SHA1 d9269339855c5617c062320b0a450184ae44dfc7
- SHA512 3b8509da9a95d9548914871ed3288d7f421133f74ccb3a1f9d37863dbc45a3732ae152e4e425dd06e705881cbd64c40ef77579f4dfcf805b58663762be083507
- TLSH
  T11221EE23D74843316B8309FA8A1AE98DF22D506CB6854154345DD0D8323B97687AF3D6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Renames multiple (87) files with added filename extension

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Discovers running processes

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32