8c27084b6f1c1f09332397131012541c93a9d700b77dd48558df92b2055598c7

Sharing

Copy URL Twitter E-mail

General

Target
Melty-Setup-1.0.69.exe
Size 96.5MB
Sample261009-razcvabc94
SHA256 8c27084b6f1c1f09332397131012541c93a9d700b77dd48558df92b2055598c7
MD5 4ad448cb516e10d2dab8815a82ad5326
SHA1 cc1ab57d323adfbfb9c43ddd61680ca393d6243c
SHA512 846a1490f69b402a6aaf09107b2a69689820caa8484e263240bce4301bdc4f4afeca2f221112ff1bd1618ad83973c0621bb9a6a7efb8999fc1a1311ab1074f6b
SSDEEP 1572864:KsOLNwhzVvqy2uBWpaBi5AC2h65j3eD8471g30j+rQiw6CIKWeTrqm:KNC2YTgUIU5BgRr5XK73
TLSH
T1D728334A2320D12FE650E33DD79BE563930E0F0B0A44D5AD4116ECA2B9B6168FBB5377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Melty-Setup-1.0.69.exe
- Size 96.5MB
- SHA256 8c27084b6f1c1f09332397131012541c93a9d700b77dd48558df92b2055598c7
- MD5 4ad448cb516e10d2dab8815a82ad5326
- SHA1 cc1ab57d323adfbfb9c43ddd61680ca393d6243c
- SHA512 846a1490f69b402a6aaf09107b2a69689820caa8484e263240bce4301bdc4f4afeca2f221112ff1bd1618ad83973c0621bb9a6a7efb8999fc1a1311ab1074f6b
- SSDEEP 1572864:KsOLNwhzVvqy2uBWpaBi5AC2h65j3eD8471g30j+rQiw6CIKWeTrqm:KNC2YTgUIU5BgRr5XK73
- TLSH
  T1D728334A2320D12FE650E33DD79BE563930E0F0B0A44D5AD4116ECA2B9B6168FBB5377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar
- Size 4.0MB
- SHA256 7d7142f6d373ad670f76c8d1e68341ab0a062868e8502333e34ebd964eab981a
- MD5 90b4738a4d5c6f07b5dbfb573dacc3f9
- SHA1 9d55e1896f2b39668217baf012d92e19fe01f263
- SHA512 52088f30bb0322cced9f8214838c9ae303d95a100f5bd5ca99d306c27f76847c35d51fff4522a763fece665e7d4e75391d9012eb5cac2cfbf3422214d959498f
- SSDEEP 49152:K1kKSMVj5aIx03zU2aw+tXhi6PJ6NPsD8lwbNQPOxdCX+q0fmrE7m3HLbS3u3W2U:KrVj4Axd+43OlQ8U
- TLSH
  T1171619496AF721225AA3B1BD6B1F4002B675C003310CD9647A9C93D46FCA53DA6F7BEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/dist/inspector-worker.cjs
- Size 1KB
- SHA256 4ab43bc0697b6d20d35e526b8d5cc44c671de154e36d8fc490e4380bc6624039
- MD5 fad747c75236f8b279e67d9b472d6be3
- SHA1 a88ec98669d92007686eccb98a3edaa7f9a484d4
- SHA512 d7fdd68130671ca1a745db94ec40be4a63490ff3d96f94d9ce76554d97aa259b3e393a5dd01221451dbcea5f4d5e8986db8a3c51a124a08f839018793f21a1b3
- TLSH
  T157314026F6F26A790636414C74319A220EA30021230D9B98E65FC7271FCCB5A41F7FC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/dist/store-record-worker.cjs
- Size 3KB
- SHA256 e59f07aff76971b4c8ea8f141d556ee8cb51d6a7d98afe5f9ad4686f2f7a8fab
- MD5 3c3b9c841963919d74c36d5f14406499
- SHA1 853693c6028357c602e7417c465fa8b243f449aa
- SHA512 c7d50253d3846315a33f3e33634f1078485950a0b3cbb29fa62a8515900b6de605b36c4f96e4b9726c6f1b0b3c7faa4b74617d8d7ab33ba7d7be883086db68eb
- TLSH
  T14181229592FA106351B7D21C7C1B264A229BC832224FD91DF45E4BD02FEA6B811F9F78
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/dist/window-tuck.exe
- Size 415KB
- SHA256 b6c2c488c64afad0b75641fb347ffdd772673fbc8560fac84e0515a64860d193
- MD5 02cddb1a51212ce0e28dfbe2a4cda234
- SHA1 b55053ae277f37683134c9507f72d959c41ca177
- SHA512 7fd2b395589d201cbcdef0d05588b6a33b2081dcecf8e0b40674e0e6b67061f3439779cc7792c3f73f43420954b853b6d33df55c8cefd72ec251816ac8212ad8
- SSDEEP 6144:H7L1KWlaxBjCKnFr6dnY2rlHpXzEkCyxU6BYL8HACd0Yxn:8lCK5EIsHBYL8HoW
- TLSH
  T133947E19FB9801F5E1ABC178CE538946D6727C8E0770D6DF13A84AA51E277E08E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/dist/windows-inspector.exe
- Size 472KB
- SHA256 872dce20525809aff4573a86ef7bf7c4201cda4d33b3eb801f272aaacc7fd412
- MD5 54e6fa2c19b89764fcd10235e12bf443
- SHA1 d61cb2d0a13f0f8f9d6a08d8c38c442edf4a93d2
- SHA512 8eb65e9427cb05635190469d457216df7be145a30d265281dc84a5d94feee1d754b9646916654c1b0d3faf297a768e5aef9de8edac35857374ab9ea07b1088f0
- SSDEEP 6144:+4n+XDA2yILyorOfQa/b9CGPTSMk+8KaR9hNMKnGeR5/rcggz9VgVKtsYFp:rNuOfQaT0GPT+fz6K3RpaVgn
- TLSH
  T16AA47D69779804F9E1B7D278CE438902E67278454371D7DF03A89A761E27AE08E3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
- MD5 8a65a1ab93601ddecb93af2a310dd68b
- SHA1 a1d449ca51b5ba67be9cbcaa7901cf9b3f1c0f04
- SHA512 25844b7975d5567b70d793369342211bac5ceb5d17fee7cc7a0a6a0a2b8d42f4188119544927da81cd88c115fad9d09993f2ef61ee228ed16fc20e0ab323482a
- TLSH
  T1DCD02B11D01DA8841049060311457428C821A859330C3EC99C5216BFEE15F632819358
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
- MD5 9fe8a485038be54d687ad7dd9dff80d3
- SHA1 76fc7b47a329b759539bca0b785ad41c083c29be
- SHA512 0f3b2ce074ede02079bdab4229f6d4ded5eb7ec64546c3b9f103114aabb35093fecfd04677a0a84d3691fb49bae8a6c5489cee946c7f5f4b86aec3e96434dfac
- TLSH
  T13AF02E5975DB81204345D3A43D28480AE4E8DCF363491E3A90C097F4BB65D7143F25BE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
- MD5 601642dc448c3b398e92ec0d19e447a1
- SHA1 114f88fca99d59eb7a1a180f0e3ece3f056f28c9
- SHA512 e67cb183e4e7f8ee30d7ca8e3357573acf6c04fa31415862d75703a9536e1c46c2a340f4b6f8a06213a05d802d0cd8b044d1e84d51a4e39211896ba3d1f9fb5d
- SSDEEP 12288:HgxgE4Zq83N97ECVgV+w1DIaEOXRq/vjwBgLI/z1o8JdX4O7eCBjj:HgCTNZD7+XR4rwH71tX4I
- TLSH
  T1CF25E4A6F5419B63C6C05A77FA4EC29E332317BDD2E9710599240B64BBCF59E0F3A102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
- MD5 bbbf518e41f7ac044cbf5e25bfae8b2d
- SHA1 5f1df07d814224931d0aef78d8b45ff89474ac78
- SHA512 02c447db478013e8d4452be017222ccd261d6a818c28e210bfac8c4c2ed2caca16c0b8bc8290af5fdd61077de43fa36cb012007609279714051640dd276be1be
- SSDEEP 12288:Zj4X5AliTSvnzjfTET2oplihyabHIEigotxcfR+DVAW9a55XdcOuFvPJ8k:Zj4X5A4Ovnzjq2oKybpUe33
- TLSH
  T15E352A4BF60C7C43E383E1BCEF89CEB1B62B75B9932680A07596419CD1D25A5CE72643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/7zip-bin/linux/ia32/7za
- Size 1.6MB
- SHA256 8400fe1f78c7033ddf16f55b82c3a520a91c424a29d5163c45c6e085c5834373
- MD5 dba8ad5c0f1a27e9e387817df9ceebbd
- SHA1 33b7ae00c218a250c30588fa134dc9946665147b
- SHA512 1276bff843177a0d4c6b6edbe4bcba26b88164853fd7a518d6adc114e1f87d01ce3efe3cb8f3e8a83355b3789b7f4da53231a0e994e0314b8e38fcee20e674e1
- SSDEEP 24576:g94/Rty7JgYr+JA7Ick1PmkRYPjQxVL5I+vjgR5ONbwe+AqDAKcNJHn36kWQ:gK/RtB0vk0d4I+vkzw+LAPJHnV
- TLSH
  T159750953ED21891CD018227194EB273AFD24C6FBD06F53AA9684FD3ABD73642978874C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32