b10070f252e7b82ccc14d6d2b99655f1f3f4aa8e5d66d499e6979a3a430cb2df

Sharing

Copy URL Twitter E-mail

General

Target
RetracFix.exe
Size 77.6MB
Sample260930-stecfsbe36
SHA256 b10070f252e7b82ccc14d6d2b99655f1f3f4aa8e5d66d499e6979a3a430cb2df
MD5 0814be4da70e8f06157e4ce60cffb16d
SHA1 3d60aa51ba32ed4faafb9717aa84026c92b165ef
SHA512 36e9ab006e6ea557424708fa329901687a9c1c1e75d306dc618457bf450fcea6966cc70073aeb07b77afb82556550b1807703d5af009394a3b22f165e289c1fd
SSDEEP 1572864:CejOYf1B4wKYDYBj+VuYbTYHGvtaFweMjz6WZF4XjzsONhq0C:C4tBn7ERg7reM36WZWTQOG0C
TLSH
T1440833E4BA76C8ECC180253BDD980CDCAE2CEC1945E690C8957F4B963934979B70A53F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RetracFix.exe
- Size 77.6MB
- SHA256 b10070f252e7b82ccc14d6d2b99655f1f3f4aa8e5d66d499e6979a3a430cb2df
- MD5 0814be4da70e8f06157e4ce60cffb16d
- SHA1 3d60aa51ba32ed4faafb9717aa84026c92b165ef
- SHA512 36e9ab006e6ea557424708fa329901687a9c1c1e75d306dc618457bf450fcea6966cc70073aeb07b77afb82556550b1807703d5af009394a3b22f165e289c1fd
- SSDEEP 1572864:CejOYf1B4wKYDYBj+VuYbTYHGvtaFweMjz6WZF4XjzsONhq0C:C4tBn7ERg7reM36WZWTQOG0C
- TLSH
  T1440833E4BA76C8ECC180253BDD980CDCAE2CEC1945E690C8957F4B963934979B70A53F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan
- UAC bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Looks for Xen service registry key.
  defense_evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/app-64.7z
- Size 77.3MB
- SHA256 04d7421b56815d91003e0a36bb756bddc64edfd6eb5551438ec7600601e33150
- MD5 d2a2a773e6eae464e67609ab3c90aa0f
- SHA1 df5ad380aca8b997aceaec79050801a1e59b40b4
- SHA512 55ac00bb0abfafe57ccb6be7f5a387dc723785044baf541f5442a115717ce1bfe3ad696c4081adaed722eb790a7000d98066a4efe7c58a8ca4ea849e2aa6570b
- SSDEEP 1572864:6ejOYf1B4wKYDYBj+VuYbTYHGvtaFweMjz6WZF4XjzsONhqa:64tBn7ERg7reM36WZWTQOGa
- TLSH
  T1CC0833E8B97688EC8180253BDD9808DCEE2CEC1945E690C8D47F4B96393497DB70A57F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral5
- Target
  chrome_100_percent.pak
- Size 163KB
- SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
- MD5 4fc6564b727baa5fecf6bf3f6116cc64
- SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
- SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
- SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
- TLSH
  T142F3E1D7B7B4EE3DCA5752B7626600B1ECB7452807A1434B178BD8763A72348D8C8793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  chrome_200_percent.pak
- Size 222KB
- SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
- MD5 47668ac5038e68a565e0a9243df3c9e5
- SHA1 38408f73501162d96757a72c63e41e78541c8e8e
- SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
- SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
- TLSH
  T1F024E1CB67B8DD3CC96706B3622601F1FCB6113856B6525B03DBEC357A9668988CD383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- MD5 e0f1ad85c0933ecce2e003a2c59ae726
- SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
- TLSH
  T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  locales/af.pak
- Size 464KB
- SHA256 57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
- MD5 862a2262d0e36414abbae1d9df0c7335
- SHA1 605438a96645b9771a6550a649cddbb216a3a5b1
- SHA512 a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73
- SSDEEP 12288:KYHoLheVm/Wnzo+E+VOSMKlNu+d2ZH2Jynua2VIzfXo0vIFNgRU2Sw+2Ss37xzOZ:LoL0Vm/Wnzob+wSMag+d2ZH2Jynua2V5
- TLSH
  T1D9A42C06EB81273D09A07696BA0945B7FF9CA26CD770B2BADD9D82360562EFC017D0D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  locales/am.pak
- Size 756KB
- SHA256 b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
- MD5 4eaa15771058480f5c574730c6bf4090
- SHA1 2b0322aae5a0927935062ea89bd8bd129fa77961
- SHA512 b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9
- SSDEEP 12288:sjsuGn8MVs2TZIuHzLzxBT2qE36jpECuzA+5P9LlVrClOwPQVx30jH8+F:HnG2TZVLzxwqEqjpECuzA+5P9LlVrClj
- TLSH
  T1CFF4B9547EF9F7570F8E8A19A4320E4E9594AD4652803C38C35AE3FC2B2DF1B4DDA219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  locales/ar.pak
- Size 829KB
- SHA256 ea49bc2ceb6b185030eaa0ee0155feca90e632390417299113b02fbe365ff731
- MD5 2b2dfafb0d258c1d2b58e51ae1ee9ab5
- SHA1 2a538491ff4023d29bdf2a053447c6016138d9f2
- SHA512 6b629ed83edfea1b1ff3c379009332e413c420de651a24160fae859e1e0948fbebab99c9da714df6dfad3b9e472dece7bee95815ceca428183f4ac0bd6d42ff3
- SSDEEP 12288:whjQkIYBukM/T/RJGX4Yxwv4UPCNakEz5cN01++QIYkpT:gjfGv9T5b++
- TLSH
  T184059BE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E74E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  locales/bg.pak
- Size 861KB
- SHA256 50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
- MD5 0e8005b17ac49f50fb60f116f822840d
- SHA1 f2486da277de22e5741356f8e73e60b7a7492510
- SHA512 5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d
- SSDEEP 24576:9MCo3qBsklYOdAs1axUYVbOAHi373Z5+3aAK5kVDV5uRumpod2JK5ITOuORx6QKq:9MCo3qBsklY/UYVbOAHi373Z83a1kVDj
- TLSH
  T1611524A15B9A68DF0101F45F98087E093CEB54FE3FE7879241642DBD39F10B886BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  locales/bn.pak
- Size 1.1MB
- SHA256 e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
- MD5 c8173f0cc63ca9e02c07abec94892b53
- SHA1 2688b199cc40bb2082247fa451eac1304608e48b
- SHA512 3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019
- SSDEEP 3072:HPvKTlIymMTAKhwg8KgMokBw20kzhY0/ukfe0/Q8hhar6j7dkjBbJrlD+B5rwDlo:HPvtMTAKhwlFpKAShhG6j7wBb85mlo
- TLSH
  T14D35EE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A25938ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  locales/ca.pak
- Size 524KB
- SHA256 4ecfa3785ab52564e0bd7dda04d59a30163561588a04f3bd1b1b71de051d2c53
- MD5 d193a3ac614f64f4754c9df5cf00e880
- SHA1 0da0f7c1a4048074f6fe9d70704aa93ff75e42f9
- SHA512 e85d18951f9a1a86514d577f9b19a4b3727523c15b4ccdd17217f6fdf69a0e774a36874108a05de1be3dcee1720b0cb19eced2d3283f57f41f5f9c5e233e1c68
- SSDEEP 12288:BLUzxDV3sCB/7kREeopxA3n5PqF4N3Mw2juwHzejm0t3lvq8+x9sfR+IsjcmlLER:2zxDVJwY6vR6QZIMN7vsyL5fdjiu
- TLSH
  T1C3B4F9239BC93B6744D2330AFB46C217F48CA9847B06D254F4AE1B1622CCADCD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  locales/cs.pak
- Size 539KB
- SHA256 1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
- MD5 70f320d38d249b48091786bd81343afc
- SHA1 367decdcdad33369250af741b45bdc2ca3b41ab3
- SHA512 02b08ed9261fd021e367995551defaf4b4f54c357409a362f4d2470423644913375cac444f62153ec2963a84880a30a36f827dbfacdd76a6222838c276cf5082
- SSDEEP 6144:Lg4k2oNIYl8pvlntLO2A8YfZA2WBe5rK8VuvNO4w3SBZmPyO8QP:Lposty2A82IBe5rK8VuvNO93SrmPP
- TLSH
  T1CCC44A1EEFA36425484002487BBE4228BD1E83540B6FB5BB6C8F9D91217677ECEF4D58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  locales/da.pak
- Size 487KB
- SHA256 438d2b1fd396c2108ca3902f69eeb372219edd5d95fe70970d8ee9e64556c9a4
- MD5 0e4207e2cf5741a8968617df9174a681
- SHA1 bf9b7558141ad30bbc921992e48d48cd6d6ab475
- SHA512 4ed8368013912c408f7e5f7b4f6f1748834e5506307b92f4b669c557efd27363a55b4e2918eb7707e798878c9492b765f24ab9c90e843f54e8641c4646bc72da
- SSDEEP 6144:ZB7xSTKzVhsN5cvfAe914eA4owlTamJw/zobqU9aFut5HPrmc+zd4bTGqewc:ZeTvyAN4aHK5vrnTpM
- TLSH
  T15AB4394B8C9C732F89AC4B65F3108EA7EB5D943CC684264FA4D8953909CFD6097BE1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  locales/de.pak
- Size 521KB
- SHA256 47253e2fcf0e4691f29b3ebbe8f888a97b28d6aeaf73ab000857a6b8d0907ff3
- MD5 141045fc1f94f93e82db06db4f7321c8
- SHA1 d63d226c531a710359cb65f4e6aa190f593b4d54
- SHA512 85c27fdc9a2cb9310bfbb05d0bcd668eb2156a37765d8fb59496739f6f1eae12afcbaadf5eea8f2db2ad8c8a0602f83500bff9cb71a429174a80bee16ec10118
- SSDEEP 6144:aZCDSOtYYQbSP3K7UpHGK3gXcaA4CwQPxJ3FIRYa2Y5h4y5XRkJWUaM8QIiCqa:aZWt/7P3K7Updgsa7/1Ghy5LUaviCqa
- TLSH
  T1C6B40703ADDF625EC782B3617301CDB77B19E36BC346312688EDD12B654B5B282AC536
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  locales/el.pak
- Size 944KB
- SHA256 6a06d1d6b566214f7c3b693052beec488f7aae5ceeca26781a5d66fade39388b
- MD5 16bcd10bc81dd8a5b3ad76c90cfb9614
- SHA1 240395860971fb9205d28602d4d4995007ee5c75
- SHA512 353a26b21848f4dd30b3aa1f4196b23571e177893ec6912db4570493664ed987e688fd66c04e509ecc58233476ebe59453260bc3569136f275fcd681ae54a174
- SSDEEP 24576:xcFHYcXPdGgxh1hxFJd9+/JXDsSfSmqHpuD2NpKyljr9AVH8hVdQ5tNDQo3/Q6fF:WFHYcXPdGgxh1hxFJd9+/JXDsSfSmqHa
- TLSH
  T1B425CFEFB4582DED8086950785D8F07C6BC62D6CE749CBD86229CB60BDF90718622D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  locales/en-GB.pak
- Size 424KB
- SHA256 4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
- MD5 a1aa885be976f3c27a413389ea88f05f
- SHA1 4c7940540d81bee00e68883f0e141c1473020297
- SHA512 8b6d67e09fbe7a2152a71532a82c1e301d56cdde34b83a9f17d9f471e258b255d5b2d4a0c39f38581da3a31cec24fb403156a8e493560d7206e1ec3db7e68b72
- SSDEEP 6144:heMA5+ocjYbYMP9ejI/AfaYzyJyC5+S6Bc0RIIf:kMhoxYMEI/+I5+Smf
- TLSH
  T1F0943C1FF784226A069311727B0AA6A2FF22D06CB35116567CBD802C33B6756C3776E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  locales/en-US.pak
- Size 428KB
- SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
- MD5 809b600d2ee9e32b0b9b586a74683e39
- SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
- SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
- SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
- TLSH
  T110944C1FF7442229069312627F09A6A2FF36D06DA35112563CBD812C33B6B66C3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  locales/es-419.pak
- Size 515KB
- SHA256 d1019c780e836e0c30fe01928d23ecdd0ca04ed8ee886adb3428e3683e4ed6ea
- MD5 088de6d12071ea5cf8d4a618ed45e7d5
- SHA1 f12a76d18b84b17906f5f8cfc78cbb370b026b09
- SHA512 8da7326cf99cce53d7ccbec0c177ff9cf6dc0009431d6c89b3e8f0475bbcd0dac4c888460b535c1070ced62f1bf1c614bb0fbe9c5583e66c42f30d6e025ed7d6
- SSDEEP 6144:LuT1RNC0Y25sqq6o36jlHDVzpnY8KJ5BXALFmQIzL5:LuFCROfoMJpGJ5BXWFq35
- TLSH
  T1ACB4F922BEC81F5310E2A389B783D753E4989545F408C29BE8EB876552CCF8CC967ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  locales/es.pak
- Size 515KB
- SHA256 f6a01c26bc18dcf701e1d4b6ff76602f14c4bb9adf9dd176c9107d5aedb4503f
- MD5 d584992a0670c5771147c01266d17362
- SHA1 d6e70e43585564d520e4b1777fac0b1e7bc6ed37
- SHA512 39db436a05955a3ad3b54ace4f2f0e8a313797d3ae8eda9cf1cab6f2ea1edba0a82c30f3b589b8c5399ed06e9fcf4ce9059d3d5a07472f05ab1f0819e42d5b73
- SSDEEP 6144:BgukFnY7cc19MukUugT4/pu+Aiw10hUnjf5Vwr5JT8o6PZ1Cu:BgpZJWzk2spbw10Wnjf5arfTQL
- TLSH
  T107B40822AACC1F6350D3A389B783D753E4949585B508C29BD8EBC76612CCF8CC967ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  locales/et.pak
- Size 468KB
- SHA256 292eb18ec61502b0e952b447f73a66143c56dd95f170981945e5aab53a6b32b3
- MD5 e7ea23d6304d5d600d884f4e3b3cb2d7
- SHA1 99fbef7eb1bde7df398cce9faf6c7c357769334a
- SHA512 23dfa1161d11faf440241b1f48f2ddbc8ec086a8e18da351734656551f0f54fe4c94b490c0d3ecc378a3de7f7713a1626a7a6c21da2500b9597b44fd08197d50
- SSDEEP 6144:5oD1EPHeXyxhmokCJ1HNRSnQp+LNmW7Fb0cmFotp43rPYJpiT/d25hjm43LPvCKt:5i1vokAwQ8FFmFotm25hjLx
- TLSH
  T1B0A42B42617E771B282452F9D337AD23DC9EE7D8B4000D976C964A1960FEF8C38B6B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  locales/fa.pak
- Size 767KB
- SHA256 7a856070430e3cfad15b96b153b1cb483cca9a1b9a43453df3707b09c748a3f2
- MD5 e2bee9eeeac231de237100fae0aa77c7
- SHA1 5e5eeb59656e2f8f4f62bc618966d38cc06a385b
- SHA512 5593c4a48e679f0f6283c3bca69838f581b6f928cc7170737778458393b6b85fab0e6ca390bc5da840f4b79de9e638015bf341c1a95e8f99770886f5354ecff6
- SSDEEP 12288:fqc8u313uyqoT+slXVfqNdNRmXzoT4RmdAQifaQ2XxFMJGk620dUhMX9OzRdpxHS:V8u313uyqoT+sXqXNRmXzoT4RmdAQifo
- TLSH
  T17EF4C2D56AAC5AB16757CA0341D33838C773AF12D34DFE40ACA1076609A5B139F4EA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  locales/fi.pak
- Size 478KB
- SHA256 e6454458dfbe150112c37f8b02f8c72c593af22e8be16980ebc854ad113fb763
- MD5 a9fc339d49ea069bd81380ae1fa0ef11
- SHA1 5f376072f38e94e252d72c5660d8120a41d73469
- SHA512 3bee6723485a9eae4aa9bfd4e7fb490ce7a0aa12cbe41443b8bd28a26fe552cd31f4a1487bd98c6bc7774df1ea16b1de94ed0f52af59baf9e17b3db815404c4d
- SSDEEP 6144:TBgYwj5XuOtY19ibb8kE6zn8VrpQRR+sDIQIOEh2a49LB5t/W2H5E3WacMkSYxEM:TiVlzY19ubgdp4a65t/tH5E3WavZhYn
- TLSH
  T1EDA45E915219C22137C8D28F79B0903EF9E9E3DD8C284896E843C7D949ED9887D7277E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  locales/fil.pak
- Size 541KB
- SHA256 ab107369d45e105a4cb4f2f6bc8da2a8c1b6c65d5e94a7ab3e703e619c083dae
- MD5 cbb431da002cc8b3be6e9fe546cd9543
- SHA1 19fbf2715098fc9f8faba1ac3b805e6680bbcca4
- SHA512 3cabbfd021e5814587dad266c4f5c9f624e9d9278f22658dafd65ff2ad2bdc5f6df8a8672614b296cea826819211e12f8e77f183007c0a79075e2f0980b99911
- SSDEEP 6144:br24A0/ksyssy7DQBrV7n2F/0inGKbmY5ZTmR9zARRq8:+4g9lUAY5RmA
- TLSH
  T129C4B605B7402748D7C352E51360A82F6AE560BC3F82786E4FBF269B6BE7CD5D270192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  locales/fr.pak
- Size 559KB
- SHA256 976622fb851378f57f81423e5625e40d0753d7a5e34caed2c39e4b130a3427b8
- MD5 59e1e573153a209c56ae3bcb390b898f
- SHA1 45f8a5469651c032c453b14bd68c85cdd6c75fc2
- SHA512 91f1b88ffb9f3362fbab7d607a68c4ca65e6b89fef7de0c986067ef7fd013c0ce35bce328ff3546cb7aafc296993e46a908ac506bb6a141088cfbc5ead948ba4
- SSDEEP 12288:kpBIVQZLqbhBlD3ET6QuaMVWvKzbyNKSZDZyMYnYJoQHc2jzDW5bxNJSWCv40wCf:uyOOVKi5i3
- TLSH
  T10CC4E65FAED432CB19C21273FB12D663DD348248F216E340D89F4695129A8ECD39F6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  resources/app.asar
- Size 31.5MB
- SHA256 502d9048a200c6b7799e67d85101fec7782a756df5642162fb38cc3a4c33e26d
- MD5 8c28e78bc0703da0510f7cf2450acc3d
- SHA1 bb7d7de3086fcbf27bccd50f2f9e3bd0ccedbf4c
- SHA512 a062942e4d891c1c5da5ecec3fb841f66d61c128209951d48296132aeb03b73ce1fc707db2e1cd071efb13a02b6a748ae62341d657bc0d64c4ef495e98714fdf
- SSDEEP 196608:hdPaw3GwwI1CWgGWobghei5yfWig7yzs4F7fJH+xTzGJ1TlCnFpndage:hdyw3lzQxqyMA7csGfgx2rT
- TLSH
  T16E775D856EBFA0930256603D6B5FF0452720D95397ECED007B7CE790EF5E8129DE8A28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
- MD5 583b1d71cd7b847ba02d734c508cd92f
- SHA1 d63966aeafa951d51967620c606e9b97399699c4
- SHA512 cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
- SSDEEP 49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7
- TLSH
  T10E363813B2858199F05DD5794B5BA632F632F8801B72B6DF52A00F192E37FE06B39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vulkan-1.dll
- Size 925KB
- SHA256 d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
- MD5 47af18d68dc7cf271f0a92707f783f64
- SHA1 64594e92a1cd7042cf6367b1843abed210db3d78
- SHA512 2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
- SSDEEP 24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo
- TLSH
  T171156D139A94456AD476D034C8C28607CAB178921726B9CF03685B087F6FFF4777EB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32