efb020c1d7efe57e4dcafb1adce0fb719b5adeeb6054b30d98db4bca0a16dc6d

Sharing

Copy URL Twitter E-mail

General

Target
BetterTwttr_1.0.1_x64-setup.exe
Size 7.6MB
Sample260928-hdan8axcpg
SHA256 efb020c1d7efe57e4dcafb1adce0fb719b5adeeb6054b30d98db4bca0a16dc6d
MD5 b438025ed2ddce1774f0f9d96a26f104
SHA1 1cabb7170b8249812a3c5ffc50b896a9dd7741d7
SHA512 427bf6ecadeee654ed3b1acf242c3ba01425964aed0faa96888b3485e5ff26bc24d3be62f7c4cae7391b9b38859a75687a804d5c0b6f54b461ec132096259b3d
SSDEEP 196608:rxwGrFVw9SZfRb1o++DQzusD9BL6NY779xkavToxCtunRu26j:rxfrFTZfl1VWQysDvLX79xkiEtncl
TLSH
T175863300716D6ABAD40B7FBC558A990BBC674B212949EB49438867768CCBCFBD8730C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BetterTwttr_1.0.1_x64-setup.exe
- Size 7.6MB
- SHA256 efb020c1d7efe57e4dcafb1adce0fb719b5adeeb6054b30d98db4bca0a16dc6d
- MD5 b438025ed2ddce1774f0f9d96a26f104
- SHA1 1cabb7170b8249812a3c5ffc50b896a9dd7741d7
- SHA512 427bf6ecadeee654ed3b1acf242c3ba01425964aed0faa96888b3485e5ff26bc24d3be62f7c4cae7391b9b38859a75687a804d5c0b6f54b461ec132096259b3d
- SSDEEP 196608:rxwGrFVw9SZfRb1o++DQzusD9BL6NY779xkavToxCtunRu26j:rxfrFTZfl1VWQysDvLX79xkiEtncl
- TLSH
  T175863300716D6ABAD40B7FBC558A990BBC674B212949EB49438867768CCBCFBD8730C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.8MB
- SHA256 81c01751c8cc385a5991abb104205d42ac70094350ee8fb9e8ea580b51bb9554
- MD5 6ad23fbb5ca5a2245c42f232cb2e6739
- SHA1 b41664c86540571f51d8b6148ff98704948e56b3
- SHA512 88f03872daa90d4c272bf4a3105e059fd2056a2511de8d851b0e0b7540ec877e84c3a9c380006c6473222bc72e0b0adc2b74c287f2ef1d43263e3878c2776a57
- SSDEEP 49152:diGy36hgmsX4Ig2LiJOHYrJFTLZixTNLhRu85U:diShgmum2WzrfLZch7U
- TLSH
  T183852212B5F88031F1F72D3269F58A71187DB9724FA45ADB1385292C5F30AC2E9353AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  better-twttr.exe
- Size 21.2MB
- SHA256 98d1a6f42bad1ad906ead937326d5a16dfd2b90a1549b118a1ad655576fae89a
- MD5 a54b5132d261d0f03163a1f570bd3f6b
- SHA1 f56859af6eed067ef7799dbbc18e582f79d66e0c
- SHA512 1f4f497251aaed37b26bd0a97957b68bc1f658e98f31e2cfb2e921f057e63863d2aaedfb120668cd562cd69d71543de003217f49984da15b0f21ba2a8a857696
- SSDEEP 393216:BboS6T70xP6ZcV6YzHmVC0TGVLqZNFmtoqn:BboS6T70xP6ZcV6YzHkv4LYqn
- TLSH
  T1EB2718257A5A996CD09BC474834B8A724A3130DB0B35B9FF449496393F7EBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral11 behavioral12