568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134

Sharing

Copy URL Twitter E-mail

General

Target
568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe
Size 22.0MB
Sample261003-py5teszyat
SHA256 568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134
MD5 2ded9cc8e86ee8282126e670790d168c
SHA1 d0b9403c64f619355bcb5fd9e4dd64e6d54dcbd0
SHA512 aa06df3cbf3a4b491f70317131d7ff561eb1034ae36c7990b6997ca26854064399f27491544ac3669d7bb2582383c6573b91e220c9f188628d82651f0e136811
SSDEEP 393216:3GhrNLxYpEIA6LlptxvpoST6A5Dc/U8dei57EdJt1dBPkk2/la4OCZ:3qlkZpLjvpoUrc/U8dj7aPkkGlaa
TLSH
T18F37332AB76C54F5E4296DF207E4FF6B4E05DC9CFE2BD85DAF45108B8426106384BA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://127.0.0.1:4173/

Targets

- Target
  568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134.exe
- Size 22.0MB
- SHA256 568bf76695a6eae730e65945e4fd6ea388849c3b982ab8985bb0b143e1c29134
- MD5 2ded9cc8e86ee8282126e670790d168c
- SHA1 d0b9403c64f619355bcb5fd9e4dd64e6d54dcbd0
- SHA512 aa06df3cbf3a4b491f70317131d7ff561eb1034ae36c7990b6997ca26854064399f27491544ac3669d7bb2582383c6573b91e220c9f188628d82651f0e136811
- SSDEEP 393216:3GhrNLxYpEIA6LlptxvpoST6A5Dc/U8dei57EdJt1dBPkk2/la4OCZ:3qlkZpLjvpoUrc/U8dj7aPkkGlaa
- TLSH
  T18F37332AB76C54F5E4296DF207E4FF6B4E05DC9CFE2BD85DAF45108B8426106384BA8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/payload/Install-CLIPVIDE.ps1
- Size 12KB
- SHA256 a86ab232fbba466ccb74d36832f6e6999d23c3516c570994eac8cad3220dffb0
- MD5 9bcb06adaee5cd8c611579b863fbc7e5
- SHA1 84df44a12aef16e0ac4c217d3a14efc161564c61
- SHA512 668a62e49bd8cd1795c67b57c8a7417f591c33f25349179e99c262a15109df65c606d76af70ef7eba3539f956752d0d5a05bd24c74237119fda9fce310c61e9c
- SSDEEP 192:DUQGBArAjMsfWmpwD0V5AwUJKG+Syft6mEaPoP/3j97mHr3tGL+xQ644TeNqZ9cF:DUQ9oLEaPoP/3cL4L+xQ644TeNqYjwi
- TLSH
  T10242FA0F6A86E065439F627988DF404E9A5F1069010E3A4897FFD348FEB51BC87AE5C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $PLUGINSDIR/payload/Start-CLIPVIDE.cmd
- Size 119B
- SHA256 e3c6259dc099e45d0f9e33d34c51737a85584508c5c07777e50e0d3d43a8e0a7
- MD5 e02808bb8670199685c64229ee009807
- SHA1 b24c604af8d35e252617573774c1d2a86bb4816f
- SHA512 6d639ab4efed65a701477d2266e4b8f44a086bcc38e6c0cd54e0ceaa033eec28c84f0e0b17702b13958aba828a8319257279b2fcb3409bbe0c0273bc15c016ca
- TLSH
  T1DAB09212565AB39AABA7DD2554DAA360181F6202231646823572463EB9092A9C1992C9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  $PLUGINSDIR/payload/Start-CLIPVIDE.ps1
- Size 1KB
- SHA256 96c093a71251fc1568094699126fb36c63fa6f57e839b08e09c1bcbc833e6c00
- MD5 43bdacfac4fbd86346bd80f3468282ce
- SHA1 8efe1f65b42f78b89dda2ebaa2369f9cf16ec583
- SHA512 33e9bcbd640130af5979535d3632c6aa59f7cd1adcab7554bf6406b4bb1c899efa3aad87e0275c0382f011e7f5e12ae8e999f3433e6273316b9acfbfb7f161f4
- TLSH
  T15631221E2B617013CAEC451828D53106939F10BE851D3908899DE353AFB66BBCBD628B
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  $PLUGINSDIR/payload/app/audio-beats.mjs
- Size 664B
- SHA256 8807cb51353e0b68a8727ea96c329e18b51108d3feab677566da5681daf61bc6
- MD5 9110268a5b348fdff428d700ff1256f7
- SHA1 c0747ce0f2453867dbf4a52685eaaa0de0d8c680
- SHA512 13f65cb8d6b3c47c8c52d95f85cc3d8140f43145d059c7f601df3c4ce4dd792b85bd17beedafc4f50638991c18041101f133835597c827cb971f0508167d6d9f
- TLSH
  T15D01D31B126509B3DB8D3F41285A3282FEB16DA139814D81C72B2E8D2713EF211CFE74
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $PLUGINSDIR/payload/app/export-caption-timing.mjs
- Size 1KB
- SHA256 abde7a48db790082882c550d3763b8326a0c59f04ac8cb310c9fc20a2a9f90e4
- MD5 3123a40558c60ce0f37108b5259a9c4e
- SHA1 a85b1cf2df66cd300b4b5d47495629f0e09fc103
- SHA512 4da04639093eaa42dc78edfa70fca433611c92754fb9d446fa40f0f47a9c707fbaf897424c05e434a18c9fc553f901974a687b13c291dc46df8fc5a125169b24
- TLSH
  T14E21C040AD11331A9652093246471E8663377133F28D9CC8277E5A7E0F577A611EF589
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $PLUGINSDIR/payload/app/export-preview-range.mjs
- Size 4KB
- SHA256 a6d08974a52a38f2e0986ad880ea9f19c0b4ff7a9a4d9459c510bd49f67326fd
- MD5 2c6608c3ce40b5514addd5b49a3a8931
- SHA1 78f08cd569a6a097fb22515fe4e1e4ed9d52a738
- SHA512 2041f34e6ad941dcea2389b3d4af54d1be18bd6b4431e386cae9ac1ba1202404cb802603479d8f93d0124044411e54e80d6dc5a4650db3f54f422bfdd4e5c375
- SSDEEP 96:Mps5K07m9MabRRRJBt6fzzPjxw/YukS+Tb1CKHs7Jdsyxa:R5K06/bRRWfXjmYukPCKGKyk
- TLSH
  T1159121C939F240374A7353F16583C7412A381523B84BE8DDFB6E9644AFA3687A5670CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $PLUGINSDIR/payload/app/export-space.mjs
- Size 952B
- SHA256 873dbab477060b30548b05fef0d710344372abbe2303206c7e237bda4bd2612c
- MD5 1fa1cf223c0cfc8234adc55c202236b2
- SHA1 6bc9d47cd3aa9f421ea45ec71ce99e4b0ab2ae4e
- SHA512 ecb95c2e21bacb4d16f6bb5abce98774fc5888bf13c869be391300ef242260276683c323d3ea0c62c46c01b7759abfbd0eef8a5348f649b19f6179cdfce3b3a0
- TLSH
  T1961104013622693D0542E7F21AD7E1016C6031077C6F45FC667EC6D89F2302F71AD5C8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $PLUGINSDIR/payload/app/hardware-encoding.mjs
- Size 4KB
- SHA256 b076a6fb22c21f1149e9bd661b5e4603b4b5d3a6c85cc2f72bd50f0d4ec327ea
- MD5 17cccd5d1499410205b6dbf8bb29bb74
- SHA1 895a5f811157e4309d0f6508ef5900152263dd33
- SHA512 0534a870c1504a209c4ce70440dfc687ef50d0b139bff9f170b1d3abc7b7f3e16cad4190516c406c5302c7b40b464de5c447c4a3507091df8758cf84dee586bd
- SSDEEP 96:6cYZ4YORDvc1CpiB2LFF9VG4WpFtlKBiQ+b8d+BpUBEuA7CKzGugMC01z58ouCY:NRDU1NuPGdXQ+wd+4BzA4oVRut
- TLSH
  T17491C7A4341297796AF139BEDC27CCA843183750786EC7D1FA2E1F002E17254B957AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $PLUGINSDIR/payload/app/public/account-client.js
- Size 3KB
- SHA256 227cd74bb222c003d2ea934f37a4e7d87a53e0dc03d554c9c5b3721c28d377c4
- MD5 dca878446d326609dc8f23c4b2698e4d
- SHA1 54cb9b43b2f5490624cc78e8f84e7d156cfaed7c
- SHA512 e9cd1ecacfaf9bf13e65e091ba099e3fb30b10f0b08e0eaf56a9454cc22174822031d721b713838c5eafc87b78226125293384e46aeb4a9f2e4585d9e2101382
- TLSH
  T1AB61B9C936D900239BE39E65BC826A05B726E1A5BCAF4460DB3043CC7E7BD196F1300A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $PLUGINSDIR/payload/app/public/account-config.js
- Size 193B
- SHA256 dfde63320ee46d02a5902026fff1c32b9104e5f815c8ae94e537c0b2b8bbf837
- MD5 a9d48f3206a880af04e45226166db115
- SHA1 af8c8d5db3ad2611d1072900b97641dfd878caeb
- SHA512 d161b246684b59c29c10e63c8ad39ae68ac9c392a9e75e39c15bc6117c865144ab894f61018ee05dabc5edfd2269036c59ff72e57dc34e7dd5315dfac9d68f90
- TLSH
  T12BC022C27720B2330F2065819942970843B2A3A11CBED49821EA937208DB405810B042
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $PLUGINSDIR/payload/app/public/account-entry.js
- Size 344B
- SHA256 eb0db0a007b15efb8a6953d0db1bef5b0627d0d96cb689f98dca3797c12e27af
- MD5 63587007bd4d96ac3dfbde0a98f787c8
- SHA1 ea5c2d4047d0c40c006231c5632422a9b3fd0532
- SHA512 f07a088abc09b9a349f068f13ee23f52be825a8ab732cfa69ab209aa6ff2e15f1a23f165c4af60b9a2e4546422acc6e50ad045ab8631b40eb113c8ae22113973
- TLSH
  T162E0CDF164C5D6329EFD459FF630B798BE3480563443742487DC8D852C6AD922DA848C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/payload/app/public/account.html
- Size 1KB
- SHA256 ef7717e559d72e1377923a981aabdad061d8bf62fd2b0addca10fe686bb28ed5
- MD5 79363732df722a7a48cf0dba7f66a05d
- SHA1 8d1447c60cc211818fd64dfee4fbd9614afffb7d
- SHA512 88b8772d1648983e8b48ea46650864c691897c091662f586835fe27baf1878d033e7980304cc0c63b9683615dacb5233ea63c111ec9fd13c1060b0ab4a905ff1
- TLSH
  T13431B191007C9E1B97218ACCB0E79E66344A820DDF853C24E66C06FE9DFF948554D55F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $PLUGINSDIR/payload/app/public/account.js
- Size 9KB
- SHA256 985b2e9467ca0ac9ce4d27b407f7ff744a5d282e9fa56edd68237b69bc9eac42
- MD5 7c6a872647dbd1b08269173759acd3cb
- SHA1 9bf2c7c52abfd835494835e9bd478c93c2decb08
- SHA512 eb6b4099a7b44ca63791dfec04ab1eeb89146367cc4733c5cb0494be088e61b60c725b28eb570eea40723e9f5f620a7602c3bd6a1133c5791ca53f91d72b63b1
- SSDEEP 192:Xj095+fQDoQJVmqxCewk1eQZ2CGSpOgbmfkhTqGGvLao+h:YT+4DhJVm8CLk1LZ2nudGvLao8
- TLSH
  T1791296D032E8183245B185B2AE959B187773D0663C8B7815EF74975C2E7BEA37B13019
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Badlisted process makes network request

Executes dropped EXE

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32