9e5422323c94eca7fe328576304a0f9800f0ced2f397be7a0cf7bf7e444c9d5d

Sharing

Copy URL Twitter E-mail

General

Target
9e5422323c94eca7fe328576304a0f9800f0ced2f397be7a0cf7bf7e444c9d5d.bin
Size 6.0MB
Sample261013-3fhstsdf96
SHA256 9e5422323c94eca7fe328576304a0f9800f0ced2f397be7a0cf7bf7e444c9d5d
MD5 688ad873279b5cefba817580fa84aed8
SHA1 1568624e1271afad7ca0bc280bc864fb0e157f04
SHA512 4a984ac46c9d7e0a55be554c279c43d57a4c95666370d54bcfe30a62953e05a3b12e245a9ec72d4ac7f14608416e4f6c4b0034bf0a363cb196fa1cf08361ef50
SSDEEP 196608:HcT+YAAyq3nY+5xGPe///KAv0umOhzYW9:HcT+BQY+iU3zMumWEW9
TLSH
T16F5633E3D123D6B7F6256A7C8DB30E0EC6B38202233517278773A1AACC8A7515F59436
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  PlinkoScanner_Premium(Trial)/HWID.dll
- Size 37KB
- SHA256 d9052729b560d819c8d75149b6ca92c48b9e1b1b0ccaa50080a74166db8eaa12
- MD5 16b35ccfcf3e6e97e182d033cb7bb748
- SHA1 dadae07416824b194557ad182546e4faf5775d0f
- SHA512 b652c2eea4ca9da97db7660b8ea3dd43d045f1d0a7302b0d7ec6b09720ff242e8e03401cedb854fe1198f5ebf5d043502ef91ca8cfe03e27d8cb223b34ba5eb7
- SSDEEP 768:LkKguW2jU37VjIOsCF6sxx2trIOvwZw094wM8roBknl+8m3uPezhW:8FljVswHgV4oanlbm+24
- TLSH
  T1B503082907BCD67AC6AD457DA0C6451087F0D94E3C43C79A6E4CD0F9FD1A7A906823EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PlinkoScanner_Premium(Trial)/chrome/content/Hashcpm.js
- Size 96KB
- SHA256 8404a588b81df19fa0d436b5acdd599176bc25633bc19df4a90c3b0e581b4904
- MD5 5268024af4ed7a78aa8dd9144c638e10
- SHA1 4dd5a84420de91a807e9be0931087b78747a34a2
- SHA512 1c044c37cdffcc6c3d861cc00d365023f1580302d0cbb94cf04a7e9f6a4457bfb3939af017406f50623231fa8bd3f7e3dd9886f7708b32591d956c8998fcf62c
- SSDEEP 96:s0CK8MwkosFX/lS2QnXFLFCziu+LnYvcRQ5ZpxqnEOTpk34RFmJ5qhOhyS/WigCf:sLK8McJlA
- TLSH
  T1DAA353C54262908586D64C03AED1FDFA5B34E6F3ABC832FA949C5B4C04ED95785EECE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  PlinkoScanner_Premium(Trial)/chrome/content/default.js
- Size 97KB
- SHA256 296175f447d4a5b8b65ea64c574e02a58d78b3feef0c64195bd86125747012fc
- MD5 4d241fd0aa9efbc3833edffd92fa846c
- SHA1 f6653a770ffc457bc7f1fe828dbcb1a7833de7e1
- SHA512 66d9fa38bfc9a6a6ad3336a7fb588f16774b65604ebfbf48e257a37e533ce2f5dda01a3b98d9b395671d8f912fe0f9c8b5d5e2bc451e9a660cdb2b8f0a7e6080
- SSDEEP 96:s0CK8MSkosZgQnXFoZPniu+LnYvcRQ5ZpxqnEIR+mCNVh3OP/qIBpkosZgQnXFo5:sLK8Mwy
- TLSH
  T1FCA35AC58162908586D64C03AED2FDFB5B24E7F39BC832FA949C5B4C04E995785EECE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  PlinkoScanner_Premium(Trial)/chrome/content/main.js
- Size 289KB
- SHA256 fa07a7b04aa0c22dd820af83145ce9acc27b9885c05c1ba43c86cdc23011ce2d
- MD5 c6c5070f5756793d63d03182c61657f5
- SHA1 d8bc2741f7e7fe1c6e6a0f82a5a6306d69239ffb
- SHA512 7568d6988fc8d5b89f6c620d3d81fda61e2c5fba675012a2b8329c3c5dba386c7f84783416961a693395e4adf3c935f929925c53df61d7622053e00210f51b0a
- SSDEEP 96:s0CK8MvCkosFX/lS2QnXFLFCziu+LnYvcRQ5ZpxqnE6PVErxyqVdOhFOiMnDxmnM:sLK8Mv/n
- TLSH
  T17B5430D14262908586D64C03AED1FDFA5B34E6F39BC872FA949C5B4C04EE85785EECE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  PlinkoScanner_Premium(Trial)/chrome/content/noHelperAppDlg.js
- Size 65KB
- SHA256 bac2e94c7b4256223292702c603418ac4ab7fa2b208f75b54be561c42a0c4b1c
- MD5 749ba402351458d1ddabca2efead4a9e
- SHA1 896c3188ce5326a4d8e6fdc6bfd92403d095b8fc
- SHA512 f5f92cec505fb20863d8974e0be010435aa07d95b349c24d4ad55375ac595d4fc55071dd489886cd0e90c831c4202ae76b55678ea5c2a14621eee08ffcb119d1
- SSDEEP 96:s0CK8M2kosZgQnXFoZPniu+LnYvcRQ5ZpxqnEOdHgOd1JRuQJrc4kosFX/lS2QnN:sLK8M/iW
- TLSH
  T1D16354C14262908586D64C03AED1FDFA5B34E6F39BC872FA949C5B4C04ED95785EECE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  PlinkoScanner_Premium(Trial)/chrome/content/options.js
- Size 871KB
- SHA256 6d650f97980271231e44843df92a893cff8733a8c746732e2916e594f49055e7
- MD5 5e24ae7457722946739be2337c405584
- SHA1 48dcb0bbad415db647d5028963969c7d21474a7b
- SHA512 35f66eb32a7f917667b928e1a7b427677ce84ec3d711730435a1d9026b5631fde49dbedcdb3e25da6db0512fe6558ff659a1947bc88c43c750433002e3c6e126
- SSDEEP 96:s0CK8MzkosFX/lS2QnXFLFCziu+LnYvcRQ5ZpxqnEfQROvndcheFhdZKENfiZ9m7:sLK8MVmXF
- TLSH
  T1ED152ED54262908582D64803AED1FDFA5B34E6F39BC872FE949C5B4C04EE85785EECE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/AccessibleMarshal.dll
- Size 12KB
- SHA256 1a91d5521350b1e22e8b5cefa7700c89074e5c43d6e95542ead0c0319c17876d
- MD5 1c2128fcba265d4ce144b9987aa63d22
- SHA1 dc24bc83ceaa5face62b8ef82f04f495dcafe3a6
- SHA512 93cf640ada77bc8d04cce527162fee4720e7b7d17c25a58a9ea2eb2dbe53d2b06a1ebb2a4bd01644e82843ab1896c3ff7654bf2fc5ada45178d3b2467b135717
- SSDEEP 192:jojeCuun4sMIcVPyAu4sMktPRj3XGUOI4RgnJXn:0Se4HdVPY4HktRHOI42nJX
- TLSH
  T18F42EA12FB5400B9D66E1E351DB24B32421B7E249EF352279FA173081C75263AF35B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/IA2Marshal.dll
- Size 30KB
- SHA256 0711aa87a3a00cb10ee3ca4f4f59056051e5fc14b2938030cd2c1f1f63be3ca8
- MD5 39e02da641a50d655ade6588966a93ff
- SHA1 91cfd0f38138ef2aee8960857ea49e01ee0c805e
- SHA512 a9a7c9121ae3f9ff5800379592be1b285b0c0f932b6372d980a88e7e14a8a57845662fd03ff8157dbed03d2d960189cf8f33f424e2cfbb4db5cc15027baa755d
- SSDEEP 384:1EEOCde2WyxTQ4nu6H6bTQ4ncewUawHl1p/yZu0G:1rC4vr4cmawHlDqZu
- TLSH
  T196E24E84B7148479D62E543648DBD335921A6E60BAD203963F903B2C7DB7513EF32BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/freebl3.dll
- Size 315KB
- SHA256 26268ab1ac72b1120e351b615123fc48160ac09128a9ca4804d26b24dcf5b598
- MD5 5b5bc754110924152e9116b2bed791c8
- SHA1 463e5d0f403b222c8fa2cafe9751e361d1d75d3c
- SHA512 c0b4c838946320645873d3529d46e8fa5fab307de35abaab4b07de65c8bdcc6f65523aed225c62c3aeb6d5cf33adddb0aac0c21da16c35587838d05134dc2ad2
- SSDEEP 6144:THqPCp7yVV5tE2UXpZEco0N8QVe9SHtC0rnTwdKg7pqSqqDL6m7PXGHrIrUf:Tv7sfUXpZEcoc8Pl0X+cnqn6eIx
- TLSH
  T142646A81FAC762B2E3C90A74B26BB77B1C351A1E6360E5D3CB556D07E4112D22A3D2DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/gmp-clearkey/0.1/clearkey.dll
- Size 182KB
- SHA256 1ef61c712c74131532f3d939903674eb0cb4fdab8406173b6ca7fd40ce3f3b96
- MD5 5c077998c86f470090b2a8e8c6be2e37
- SHA1 d0f63030e296207c033737eebf9aa8abe9e03a4d
- SHA512 6c98711738b598a46869a87769b356e5a99f4e260b7eed71ba8e140de352f1b9386e607a454f5e429cc24b0785a45a2e6f11bfb5a59de370edc042c3fb79d2c1
- SSDEEP 3072:0nqAyFSo90YeMsrQrsM47p2+XtJ0r8HssYHB+Xdjx1gZzX:aqpS8nsnHNjm8oBAxczX
- TLSH
  T187049E0176C1C0B9D6BF123605766F314A7CBD714BA2DE5AABD88C8D5B34180B736BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/gmp-clearkey/2.1/sniclmainbin.exe
- Size 35.2MB
- SHA256 40c5baa1404de9eff3daec3149a61bb0881d9dcfcad42d2a7ecbf98566b4f45e
- MD5 568a55ee516f76589cce5ae1c302caea
- SHA1 0da9a9af425a56b70ed15dd42eb88a4c18feab3e
- SHA512 893ad427495c0fc21d762959101712cf196b1195fc37d5518f08e2a8c19b2640d346581b6a485b5289994b0c014a483826f2e371713e3086a8ad92f40508ba8c
- SSDEEP 24576:WFJZrOe7tptV7rPVYJewcd1UMYQe9SY8mZnTn4Xliy6C79:WrNOYfjrGewcTUhSXm5C79
- TLSH
  T16E875D11BE479A6FC09EC470824A46622A31B8CA0B39BEFF51C453753E66AF51F7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/gmp-clearkey/2.3/clearkey.dll
- Size 182KB
- SHA256 1ef61c712c74131532f3d939903674eb0cb4fdab8406173b6ca7fd40ce3f3b96
- MD5 5c077998c86f470090b2a8e8c6be2e37
- SHA1 d0f63030e296207c033737eebf9aa8abe9e03a4d
- SHA512 6c98711738b598a46869a87769b356e5a99f4e260b7eed71ba8e140de352f1b9386e607a454f5e429cc24b0785a45a2e6f11bfb5a59de370edc042c3fb79d2c1
- SSDEEP 3072:0nqAyFSo90YeMsrQrsM47p2+XtJ0r8HssYHB+Xdjx1gZzX:aqpS8nsnHNjm8oBAxczX
- TLSH
  T187049E0176C1C0B9D6BF123605766F314A7CBD714BA2DE5AABD88C8D5B34180B736BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/icuuc52.dll
- Size 798KB
- SHA256 0c8e7838e5f852bbcef14c3bf03f967760bed6f8361682d05db24e754e9e05e4
- MD5 50c282e18c65f91d103cc365c72d521f
- SHA1 4b84868f7aecc7744515dd2c04b4316b22a4cbec
- SHA512 565ffb4c5b8a40b72e218b7f763d635f5ce411f0b37380a43f76e0b03e898f4bc0ad7d4c2ab4e7ff487ada6bc264905f54310aac2cfa36af80a2177331d32f65
- SSDEEP 12288:Rb8GF8tXY/k4qNXZC+0hCcoX+51rhN5ynHvfz64:R/8tIMzNJIL84hXynHvfz64
- TLSH
  T1EE056D43FF9350B2D7DB9235253B3F2437759C00CF21CAA2B6D91B216AAB2E0456E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/js-gdb.py
- Size 300B
- SHA256 d0c6661686d37681fe3e847937c0fa976fde828aac751db2110178bbca992f6d
- MD5 387d32002e1c086388cc7b125c941991
- SHA1 75aaaf0d1ca186396f51c4112b112a33af9e7a7b
- SHA512 91dea3de8dafbf7646c7c571ec746d246200e7835c58924ab1f1644cc5c287c4c9c34bb08343916ca2cddeb05f91dda9f57133f077b1f3dc30227b0a013772ec
- TLSH
  T1D1E0C263D0942469E516CB883C2A32B8857ABB77FDE8408C010D85AD8B83C45AEF6C96
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/libEGL.dll
- Size 34KB
- SHA256 dde17abc68e14bc345aaf51ef96ba99eb6aa28038d4e9fa21db3667a795ebe12
- MD5 4f8c7348c196f2629fcdb866018e929c
- SHA1 db83b4ef611807011809c5b64ee23b97d5af35ee
- SHA512 f5afda4e3d2b11f13bf874a593f4b0dd9b067eadf89a45869076d7aac3015e667ceba3bb5feba47cedb68bd35262273cea8259aeccd56130572e5bd635a45ad4
- SSDEEP 768:bsGQrHQpt1DWK9IiKojwZ9MEwHTvANVNLK1R:0rHU5wZ9MEwHLGe1R
- TLSH
  T1CDF29E83A39980F3CB8B62B9A89B373AC7FC7A4148D39213EF56914D1F65641E133B45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  PlinkoScanner_Premium(Trial)/hashdecrypter/libGLESv2.dll
- Size 882KB
- SHA256 3a55143e12c91380a0a87d169a6a170364d15614fe10f832609d22381a69aacd
- MD5 50934a1c0af4abe0d027adaded227c3e
- SHA1 2b05b24a44b3b1e1a07b208ce10da90d4490279a
- SHA512 2b30db7dd2639d3d1b5e49dcb753eea8cfc9425746a9e6b1447fde2a89f665c198f65d3a0f069fcd716e05fd341c4d803881d8dccfe362c4db19d455a89c9755
- SSDEEP 12288:HdZcSiZSV6bLtVBCohLSL4KrQhbVN1kK+oX4Rax0QOn92k4O:HdcXtV5kER+oIRacncO
- TLSH
  T149159ED3F7C781F5EEAB25F04492336EE774AF050264D602E7E82E09ED25262562F394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32