65a8c72a0fb32ec3aa50a73f91451b3b2ea30c801cd6ad0bb14f5e4913e11b8e

General

Target
Dorion_6.13.2_win64_portable.zip
Size 7.1MB
Sample261003-2a3elsyz2p
SHA256 65a8c72a0fb32ec3aa50a73f91451b3b2ea30c801cd6ad0bb14f5e4913e11b8e
MD5 48c5b259b0134fedf03026a99a19f649
SHA1 94e7c811364b087d8562e9172bbcf4789771cbfd
SHA512 8eeadd77cafc368f9d85cd7f537a244724aa3b39f565689c5cce06ed3765d05552a3f14d91e0900b312ec90245029c8288e0b64de22f20a6d050b3f3f43e7ac6
SSDEEP 196608:e6VRiq16oP6bxE7DG3+lV364eu4x5idi7rDoCLOB0fBy7:lVpfydEY+lV36S46inDo4OL7
TLSH
T13276336875F823B3E729D9231FA73A48B7459CBF6E946342100B0472B95B3E6F706871
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Dorion.exe
- Size 18.2MB
- SHA256 493748bde88b065fdf76abecc63f364cd92a100836446be286c7dd39210db1c8
- MD5 c66cd842df1a16a0dbedead92aa25fc3
- SHA1 3be81fd9540efd5f6dd79bc977abf9a10f17e51c
- SHA512 a884fe60db4be6c4ea6a1392211ccb70b952181503387d4d44288fc8de69915cb1ef53742e63b317f9c5805acdc4c2e8a1de83f93970002bcf69927cc5b8fe01
- SSDEEP 98304:G5Aw5c1qhtdhIHu73wZZH9f8XV05k7WuvVpiUyZfUIOVtBOoNrP9Rj2CnOjC0bQp:DwtF77jyUIOV5mu0cb/KrE7p
- TLSH
  T14F1707117A5B99ACC19AC870834A8A734E2130DF0A36B9BF45C456393F6DBF46F2C359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1
- Target
  extension/background.js
- Size 885B
- SHA256 1b4368ab5b4f68a873b0ebb032fc28969ae128745d3fca2c46450f223ad91e02
- MD5 1c14b14559385dc7734b3155c1d830d4
- SHA1 2d735c4c109760f11b0a7f9b9df127e1e57a9e67
- SHA512 3bfe6c869df37afc121b5968f9db0144f0e483b457f2e2ad2d3da6399dcca5fd87edecfcda10a69ba2d077d8ad76aeb5d6ece124bec171c7bc967073bf858d2b
- TLSH
  T19D1100AF1C92811911F14B65CB13CBCAEB342C3E6272A1AC355C8AAA17F02C5465DBCD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  injection/shelter.js
- Size 221KB
- SHA256 9f40d258d0702ffef1ed9988b75181a006e9997f1078895ee1fc76837d380d67
- MD5 91a3423ce5d0b5582c05ff465b37940b
- SHA1 b4d7c20c5e3e663a203c14ab22f9b0d4801367c6
- SHA512 29a71c53f4c0833d6801518120b3600ff26e6e4ebc324145a3088cc27faaa1ebd1c360d804fe05a668cafdbbb0b9f60434b79964a3a81d350ca082318b0a07a8
- SSDEEP 3072:5fCrrm6sYE38UpI9Z8gzCvtySKBz/+t6pMm5KEx7KSSqcnBXjrGV9bG8wn2UewMa:lMeyb+96YAwew8Li
- TLSH
  T1AB246B957360B2BEA79F42D5983D4185B33D64B7306E043CFBBC97A02A8194997E7F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  updater.exe
- Size 2.2MB
- SHA256 117f8d821a9a0032601e6c301a58007fa7c5bb898d40a375939d5f52b2c1488a
- MD5 2ee387e5c96c32c149e356373c600c85
- SHA1 cc662ff233ba107839546675be17cc60860a871d
- SHA512 0eae109fb4934f310a7c31ecb23e8b5ca2c9c7a699535ac2d332b95b8688bc5530bd853729d97918fa8b6cdd32ee22f0c545f7285a0a391a34e38f4b65da8aa7
- SSDEEP 49152:o8P9mSlEj/uhCE7YDqX9QI/hbfgFhm3Xz78KqY5fIU6iGwzS:7ASmDuxPw+GwzS
- TLSH
  T14CA55A12BA5FD4ECD199C474934B4A726E2274CB0B26B9FF01D859393E6BAE01B3C705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4