9585c5d80679c51ffea567b37abbb0436ae3103a968ee9ab2b3a5442b74055fd

Sharing

Copy URL Twitter E-mail

General

Target
Numidia Launcher Setup 1.1.0.exe
Size 98.5MB
Sample260924-wtbs4sgf63
SHA256 9585c5d80679c51ffea567b37abbb0436ae3103a968ee9ab2b3a5442b74055fd
MD5 fd17431845bf58548ef05f168b83e1d7
SHA1 102c3f596260155f16c77f86f59c0e7ef95c637b
SHA512 497560a660958002cb498ee5a0027513772b615cce496dd14498b657aeccbd537b2d83e0763497ac04e9579c4f85ff83f6df0b82901ed0bc6bf0b77a84ce2171
SSDEEP 3145728:4iuSLi+0wOfT15GGZI7JPZKXTT3b2b4AE+digAYyQ/4D:nusi+0nT7NKJRKnbujlID
TLSH
T19D3833BE05D6250BCB924EB602267D37ED44C8472EE819E630B474787B71C85FFAE492
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Numidia Launcher Setup 1.1.0.exe
- Size 98.5MB
- SHA256 9585c5d80679c51ffea567b37abbb0436ae3103a968ee9ab2b3a5442b74055fd
- MD5 fd17431845bf58548ef05f168b83e1d7
- SHA1 102c3f596260155f16c77f86f59c0e7ef95c637b
- SHA512 497560a660958002cb498ee5a0027513772b615cce496dd14498b657aeccbd537b2d83e0763497ac04e9579c4f85ff83f6df0b82901ed0bc6bf0b77a84ce2171
- SSDEEP 3145728:4iuSLi+0wOfT15GGZI7JPZKXTT3b2b4AE+digAYyQ/4D:nusi+0nT7NKJRKnbujlID
- TLSH
  T19D3833BE05D6250BCB924EB602267D37ED44C8472EE819E630B474787B71C85FFAE492
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 177B
- SHA256 449dd3aa78e31d6c6b4606f7f8b68df04534c65bf15cd6f2b5668d87dcef988e
- MD5 27b8661cefad5b3369b70bc0533ea372
- SHA1 87221ed5454fcf03865a8e733012e90c02c2aec5
- SHA512 dae208b80aff87e805759b523e37223c0bb16774b20733c56507123e125b5050e9e75d67c9384465dff968df3cbb70ece217975bee052b70645a5468987e76b4
- TLSH
  T1DAC080BF7563100A46503FC45FC3755D1C4D67A470954E5074D075BC6274259C9DB18A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Numidia Launcher.exe
- Size 234.8MB
- SHA256 783e7e48407c4b1cb519efcdff523e2018e06ca2a1bcbffe89556ea402aabfeb
- MD5 0c82a2e2c35f115b00ac941dfbe001f8
- SHA1 5e3a7202b67f6419952b043f0403996e81a2a5b2
- SHA512 0042ad38e02e1b7f966768f070108d6d7b06e45595b830b899f85526fc6afab905c0ee4e0791f600b37c1045b4cd1f2d6dce07c4599f7211b11c3f9b16092c33
- SSDEEP 1572864:xGE5DqTVOxDizCPl+kZuZC5myZacAaUIf6N6kD1+LVyR/U66Mb5/AOrFqYwz3yH5:NDJtNDAvwr
- TLSH
  T14CC89C03E29641D9C05DC1B98B5A9633FE71B8054B25A3DF2B5847922F76EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.6MB
- SHA256 b2b5c67bc4a9c92a0ea87000415e7970488d1ca25767518d4cc27b88f18fb6ac
- MD5 cee074050dc69365e9aae95df75a6c4b
- SHA1 63ab7e0b39617d8ca664181bf0607b47ee2327bc
- SHA512 13764e85ae945289efa6bf8153f158ed5d1fa44d10eff2f8b25fa0b6ee43f70241977ec3745102442a2132c45243934934abcb574d83941672cc4e05ece03a12
- SSDEEP 196608:nSXoV4uilhx0LFp3jPM4OP84EVVoxZGiH+l27sT0d0nuzzDQV8xC2PgIxXhcN0Ri:nSw4dP0LX3jrOTOOGVGsTsrDieoIvr
- TLSH
  T10F4729122646D49DC099C879C7678B268A2C30E73FA7B9EFC0F451212B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 336587847c4ed3ef1a195d1aaea3d3951c9749a035ffa7951df4c0e02971e4e0
- MD5 4759e3f8c97ac46b9c034f1325873b6e
- SHA1 c5d4dcc4960025cf42c730a1499ebae1fbedc0d4
- SHA512 366d2555321563532d9c8862a46b2186c746782e2f57d541648199d0a9c923dbe52f4f18f9f66ae3990395188290a34d0e77210a7d12700894567a7be72f964d
- SSDEEP 49152:l1p5IU7Bpdk9i9ZDtoAwULMsvpTwDownIxQ2t46aLuE5TYvXXrE:llBOi9ZpoAlxFaLuE5Tc
- TLSH
  T116E5AE02F6D251EDD019C03497AB9213F271780A8F205AEF17E05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/app.asar
- Size 1.0MB
- SHA256 effcc35e28afe8c563be86e0c54be686b2060caa25ec3279e6979b2747329e16
- MD5 e07c12cebec4d7f893edba0b0f05ba78
- SHA1 51a9d271e40dc0dc32778fa8d68ac4d94c45ffa2
- SHA512 d3e1afa783ccf1cb134447b8dd28099e30c3f385e238e441592994b7d101ca44f1bca78be82a9c47951eef4864e1da612e832fea59019739845ec8ffbc71c9ab
- SSDEEP 12288:zKRjydRjw0AhJKxlw8W3D0nCPpUBKqMMHwGkyQXfmYkPpDLM8c9u5Kv5FRjydRj7:4ydVMMlw8qzpqOGk3X9kx+MKvhydVMxK
- TLSH
  T1443512675AF900354AA3A56A2AAB65073736A003F504C914BDDC02C81FDDFA8DAF73DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 cfb8a533c5da1ade3fd4e66ebd0acf7186bd17fb3cc09d48809a7909c4aaf0f8
- MD5 6f17929b9342a564da3a5832c074d751
- SHA1 ddd64ab18664f90cb397fdcabe07e9be66856bd5
- SHA512 f6c06ca5902bd11d125a4fd13dd0c9fb465ee442efeb80ccd12b85d903d3ac9bc5040a001aa1e2a76cfb324bbea830449c395a3f3641f18916db0d3dce0c6763
- SSDEEP 49152:Efbla/kztXdN2/HCkOaGCfTBB+PwpvA4Z8dLy8c+eVogBfYVxGgxvktn/yenp+p:EfblD0ya0WP810
- TLSH
  T10F464903F68681D9C06DE6798B5FA623F671F8800B22B6DF56A00F192E65FE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  vulkan-1.dll
- Size 917KB
- SHA256 c1b383f18c0949f233e949ae197c2ad4c416abe7790894d7e395d73116403b4f
- MD5 ad06ea652ef4d24ea53904867299ec82
- SHA1 b329b64ff59fd8d189a40344fb5be4157ed08d59
- SHA512 4264303f7b22205e5c2fe48c5d0c9cec0d9cdd16a0995fee1c43b33c8f17f21839eca78204f74309582ede932e24952dae85694a0a5b28187e1d60f57f3884f4
- SSDEEP 24576:N6sHcf38sq8YEkLUisjJSEZlUWnVqwiKNlC1E+Dkw7+DQ6g3v0TAE7yoeHYxr:gsHcf38sqykoiulXVqNKNlC1E+Dkw7+T
- TLSH
  T147156C63D7548AB9D676C034D9D18A0389F174812322BACF02B917147F6AFF46B7CB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $R0/Uninstall Numidia Launcher.exe
- Size 311KB
- SHA256 4fbee24a3390bdbc87f056bb2fc1401886785d7e281f04ebf3df857b0cdb33be
- MD5 2ac52ae04aeaac0122f81ccfe804581a
- SHA1 3cc5dd77871b9a5812329d1be745308bb4665bff
- SHA512 a4f75dae554af9ef5932dd02b170554c6b354313d547a9f3f824ba5894f1971fba773978bc9a10172100a06230a0e6b66cab9f015926fc1a9216640405241c18
- SSDEEP 6144:A740IMeE9tNyAYCy1jwW4GrZKaqYGX5yGu5NExPX2Ua8T2t0EyL+ya6:aPRjydRjw04hJc5NMPGCLRKJ6
- TLSH
  T169641223F7B0C16BE8E68E3266B663CB4677B25028514F439FD4220D3A96791CD9D392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral31 behavioral32