455ac4c82e39bf726130d12b5206be3d6443ebbbd022b900f7dc4c7d0dd6d276

Sharing

Copy URL Twitter E-mail

General

Target
app.v2.9.2.exe
Size 70.9MB
Sample260920-1bawbas1cv
SHA256 455ac4c82e39bf726130d12b5206be3d6443ebbbd022b900f7dc4c7d0dd6d276
MD5 8dcf7359ac57b3b4614dd62e4bbe3e79
SHA1 ea3e86b11335c5ac0b5faa70fe662e1aac4d0513
SHA512 b0feba82e17ab4951e8069fdf9d1d392303dcc08fbba28d6d16eaefe9e6c7799f897bfbdf42896c54dd354ae3ecb422763c45d20f66ab68b0019e0d02f7fc7bc
SSDEEP 1572864:YOe4hqIZHv/HpynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJzdu:YOe4osPvgI/0A/3/vHLosENdu
TLSH
T117F73363BD7A49B5C0D1B7BDA01F45A58A2B380E5E0E10B5B36F51BBE8F19014E264CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  app.v2.9.2.exe
- Size 70.9MB
- SHA256 455ac4c82e39bf726130d12b5206be3d6443ebbbd022b900f7dc4c7d0dd6d276
- MD5 8dcf7359ac57b3b4614dd62e4bbe3e79
- SHA1 ea3e86b11335c5ac0b5faa70fe662e1aac4d0513
- SHA512 b0feba82e17ab4951e8069fdf9d1d392303dcc08fbba28d6d16eaefe9e6c7799f897bfbdf42896c54dd354ae3ecb422763c45d20f66ab68b0019e0d02f7fc7bc
- SSDEEP 1572864:YOe4hqIZHv/HpynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJzdu:YOe4osPvgI/0A/3/vHLosENdu
- TLSH
  T117F73363BD7A49B5C0D1B7BDA01F45A58A2B380E5E0E10B5B36F51BBE8F19014E264CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  HydraSteamTools.exe
- Size 168.6MB
- SHA256 fd84adebf7b45c3b13ad65d8dda461f2dc5b8a1cbf7a21e8c90e0daca4d13ca4
- MD5 db6d726771df9fc6c4399936976fa3f3
- SHA1 0a4fcd4baccac31fb68a1b017ad43f99cbc09e0c
- SHA512 cb29b0864e81eb40dc624435de5ba724485d7b01b21724a12405117e5dd4dc032bc15373d8e86101f7dac94e597b9729828bbbf511d33c0b25789e478c7ff90e
- SSDEEP 1572864:3OhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:rgmeNxNNZxqV
- TLSH
  T180887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral11 behavioral12
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
- MD5 fa145097e0274da929aacd68c31338ab
- SHA1 a999806ef0c15593100e21bc8632d7b1806bac47
- SHA512 d4898eed2ea09cb9b1810d783558ee7bf284701734437fbd9e1035138216e1ddbddd77d588a0b722adc5c5fd4a245871537bfb9b168910fc2bffbd6cb78c3c9f
- SSDEEP 49152:pPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU9n7xN:9SOONYbQG7m8bdazl9n7r
- TLSH
  T1D7D5AE06F6D640D9D01DC074869F9223F631354A8B24A7EF1B909A252FBBFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  libEGL.dll
- Size 467KB
- SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
- MD5 5db499ae909083620e47eeea1623b2af
- SHA1 bc23303d6885b8f5c3fb84b3fecdf1a678e94a25
- SHA512 d656bfa6d59c495d85eee872b372f7fba24f89101c38de1de904ece0d9ffa6eb93de81fdf674efa5ef724ea73188b908b8ad32cfee03c656accb835683929311
- SSDEEP 6144:ZuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+gehJp/Ej4:w0iKbbTfDVJ2dWQo+genp/EU
- TLSH
  T1A2A48D15779444A9E06BC174CA534642EE72B8960F25FBDF03A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  libGLESv2.dll
- Size 7.4MB
- SHA256 ee039e42a4948e9f26ece8515f3c699014fa7803ae597cd3427fa1548962f9af
- MD5 57c23aa2c39f11528e56a48ea1824036
- SHA1 d4fbf180266eb210f8d83360cbbd3804249c60b8
- SHA512 77487060b824cc70b30b30b144b8f174fd08ca6a298fd8c8f45d8417b90b7914a0d135edab39d6a5b2b883d49e9386da382a9ce5c52dc07ecd147f49118efa63
- SSDEEP 98304:Ceo+zGD6g/ZXxUhH2jsS5Tgg+uPGOja21pcwXm3zq:C1u0MhHUmkjFCzq
- TLSH
  T1C6768C03F29641D9C05DD2B98B5B9123FA30B8944B34B6DF2A5847253F77BE06B3AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27 behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/linux/x64/7za
- Size 1.4MB
- SHA256 afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- MD5 6a2e4039a2f56265369f22ecb1a19fd5
- SHA1 b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA512 796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP 24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
- TLSH
  T146657C43F9B6547DCE9AC775821E9232F678F44906309F37B284EB302A52E60DF69B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  resources/app.asar.unpacked/node_modules/7zip-min/node_modules/7zip-bin/linux/x64/build.sh
- Size 266B
- SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
- MD5 08025b57ddf3df9bc3e2844d86e4135f
- SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
- SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
- TLSH
  T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Obfuscated Files or Information: Command Obfuscation

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32