27486b7d87f4ac8ea112a406ec3a740a76493d6ba33e445b16f858d0a1c252ad

Sharing

Copy URL Twitter E-mail

General

Target
NoRiskClient-Windows-setup.exe
Size 19.1MB
Sample261001-qvhp6ayaka
SHA256 27486b7d87f4ac8ea112a406ec3a740a76493d6ba33e445b16f858d0a1c252ad
MD5 ca9d91752582dcd758d2c609d2034cc8
SHA1 db29e9c1664f7eaaa5996cfa14eac1893617730c
SHA512 21c4999ebd87dda0881be5c5c0d065dafb3d0e2eed193ccb71142d75924aea718a97209b4891801de2009bd554aeec8fac37ea1ecf842f1bf2845068dac9223c
SSDEEP 393216:QjTla9KsDexeOuukexBFEx8u0j7m7CxioHpNSMYywfNe4rMtJADBMa/:QFKKRkexixCxiS4ywfNzMUDf
TLSH
T1E317339607789A96C5C1767C6F382EA477FC85CD2BB93D464B6C2A884B50D70DCACCC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  NoRiskClient-Windows-setup.exe
- Size 19.1MB
- SHA256 27486b7d87f4ac8ea112a406ec3a740a76493d6ba33e445b16f858d0a1c252ad
- MD5 ca9d91752582dcd758d2c609d2034cc8
- SHA1 db29e9c1664f7eaaa5996cfa14eac1893617730c
- SHA512 21c4999ebd87dda0881be5c5c0d065dafb3d0e2eed193ccb71142d75924aea718a97209b4891801de2009bd554aeec8fac37ea1ecf842f1bf2845068dac9223c
- SSDEEP 393216:QjTla9KsDexeOuukexBFEx8u0j7m7CxioHpNSMYywfNe4rMtJADBMa/:QFKKRkexixCxiS4ywfNzMUDf
- TLSH
  T1E317339607789A96C5C1767C6F382EA477FC85CD2BB93D464B6C2A884B50D70DCACCC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- TLSH
  T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 30KB
- SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
- MD5 fc4691e51cdfac476b2fc63bbe951e82
- SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
- SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
- SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
- TLSH
  T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.8MB
- SHA256 83004a28553bcf2f932bf03564fbab407b8e1f59cd265f8dc99cc53d028e459c
- MD5 7310a0f48396b5a5a64672e50cd71558
- SHA1 1ab49e44f257b5bf663fc4d5f659fe0717fd6eeb
- SHA512 1ba083e40bc0ff4316ce91af70f9b5b4aeb8227635483dcf37bc7dfaffcf0780617e89834c08f0b5de87110cf0369257a760d1d261e6ed311d9bea41af9ab239
- SSDEEP 49152:SiGh3YjufiUIQ+W2P3pGBoVkpdgWI80zYiHqYAh0amwXo:Sif6fiUeT3uoVkpdglC6qGbco
- TLSH
  T1C78522007AE58032F1B72931A5F4DAB41E7EFC716B7A98DF17840A582E309E1D639367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  noriskclient-launcher-v3.exe
- Size 31.9MB
- SHA256 ec8151ce047efb8ca8cd059314574b76a1d601de820e43ff0aea471f32055939
- MD5 9293eb809dd4cb7ac2e97e603965668c
- SHA1 4326ef87926c5a1e3860dcd37bbe138ae30941a6
- SHA512 342c1565002956ef6e49b86932544449fa5df666080cf4242dd72d584989507f723cd4bf86d12f75ccd402d785e8c7144bf0f6f67f71213b1977dc5b8faf5509
- SSDEEP 393216:6OT+83c/ixyBcW3z6j/MOXidvJYFBObpvDrnnj2gaSjTO:BTZ3c/heW3z6jXXidCFBOdpLTO
- TLSH
  T147779D07F29180E4D0AEC478835AE637EB72BC894525B25F5BE4BB112F79F50AB0D319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral13 behavioral14