86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d

Sharing

Copy URL Twitter E-mail

General

Target
86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
Size 2.9MB
Sample261014-px2elsvycy
SHA256 86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
MD5 0525a8c7da934bfd281219f13232e1b7
SHA1 44dd95d1fd5475870e812d265b00a9cfbd387f30
SHA512 0ff9b988f04ccd217a0bccecbb32b52a68d56c593cfd81fe204c88b4e2f9d82e39f068cd27e5b91968e8ccff97f073da56712e4bc9ec466ad528d6867d03bbe3
SSDEEP 49152:toAMRFjec63fslZDP0O0Gdk0BQzGaIDao0DAnkTqFvw/cjRAVlXe/6D2LxR:t5ql63+Zzwl0BaGVeAvvwMU46Di/
TLSH
T1AEE5339080E051E3E7ED0A362F6AC0721B46166E47978B09E7357C1FEC23256DFBB295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
- Size 2.9MB
- SHA256 86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
- MD5 0525a8c7da934bfd281219f13232e1b7
- SHA1 44dd95d1fd5475870e812d265b00a9cfbd387f30
- SHA512 0ff9b988f04ccd217a0bccecbb32b52a68d56c593cfd81fe204c88b4e2f9d82e39f068cd27e5b91968e8ccff97f073da56712e4bc9ec466ad528d6867d03bbe3
- SSDEEP 49152:toAMRFjec63fslZDP0O0Gdk0BQzGaIDao0DAnkTqFvw/cjRAVlXe/6D2LxR:t5ql63+Zzwl0BaGVeAvvwMU46Di/
- TLSH
  T1AEE5339080E051E3E7ED0A362F6AC0721B46166E47978B09E7357C1FEC23256DFBB295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  gafn.exe
- Size 8.1MB
- SHA256 f0721f9f746fc3812bcac94490792153547ead8584cf9b7f3ff717bf8b1ba72e
- MD5 b8ce796e78f4b383de45b4c25aad4657
- SHA1 ee05bc0ed4bde9edab64862f7f6a8612a590ed62
- SHA512 f6508def1be7a6c22120422ac6b19f4411ddd31c30723886d02d4d1dddf62635f37bb3c75621448ebaf40d97e7d61a354ca082a58e293ede2fc1e86c6ae307ac
- SSDEEP 49152:TmmdXV07evBdA+hzBTo1qfYacrta4QWJB2e+SYhdhGLKsu2Fwa6pXbtroIlwrXtD:bqQyYxsB2e+SnC+g6/X+LlaUJr8hxSC
- TLSH
  T10B8618057F8A6C99D0CDCC70C24B8BA30E1130DB1A36F9AF89D616192F7E6B55F29358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral15 behavioral16
- Target
  windows/bin/service/GafnVpnService.dll
- Size 83KB
- SHA256 ddb46b9c892450b7b1711ed14d0a8c802a7aab21bc71a4d633f8b22d7a69df8e
- MD5 1a540eb68da2a51b27b0e42d24141d2d
- SHA1 cf92a1c850afe31efd6a6ed519271c5dc6980bf5
- SHA512 705e0f0b39bf8928405eac61743d1a9dc10c6cfddfa1093b1841768cbf8cd84bfdf48fe816d6e3ca46c5c0707b1b64b60d2b33b187e91b8a7286b312f50661fc
- SSDEEP 1536:FWdnrM3ZW3b6w4GLcZljmuafED99IX2AK8W2TQrftx3dmmzPEu534yQttRA+iutN:FqkkcXPLbmmzPEm34NttRA+jnlki/dL
- TLSH
  T13683184467FC0A1BE2FE2BBCA87056104B76F5566573D3AE0E88709A98B7BC08D11773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  windows/bin/service/GafnVpnService.exe
- Size 148KB
- SHA256 9466af979e9143424fc8632e6e9db6118b94aba2233c4e03b83484188d981088
- MD5 e9ef1143f3769edac9fc1500089a65e0
- SHA1 1604d3e7f00d9ddb2cc4f1d422cf6489d9ec7f86
- SHA512 19fc71a3a6869bad472a7096b2a25de26c2d36387b468b756b4fc671683706f5130ad6d03d3436769107c92ee402d9e1d4f5e6fac4e1057f1a4f1a0dfa96905c
- SSDEEP 3072:mqeXA/4yIbHkNPN+6H6xCYOiVUE265PJj:mvdHkNFdaxmVEvJ
- TLSH
  T1A8E33B07E2A851BDE1B7D679CD924D41FB7278598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  windows/bin/service/Microsoft.Extensions.Configuration.Abstractions.dll
- Size 27KB
- SHA256 fefcdb267a73099cb90e5af56b5ef2bca59bed974339b3a6810352bde23537a6
- MD5 e1f852e450395bd9cad83625ca41afab
- SHA1 8a5c6332c4208e319e648c8850ab709c82efe48d
- SHA512 54fd5acaa24c426b42aee7b855b6614c9c1e2676d0f54683d4a2b059db7c9bda70988c6ceb43f488abc34759f575cbdb75c3f0649cf932cf5fa2f53a66cf2881
- SSDEEP 384:Hxrv7hVmaET50kv96TG/FwzzRjz6qMvckxGMCWsfNWCx5kHRN78DuNNPR9zbKrQV:97hUaETSkXZp32No8D69zQGF
- TLSH
  T1C1C26C6953AC9327CCAB1F71F5F1D4412E36E7E27811DA2E589EF1090867B805B32729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  windows/bin/service/Microsoft.Extensions.Configuration.Binder.dll
- Size 41KB
- SHA256 beac12f7bba4e22cda2acd9ddfe944a4ed56abec414e084edd147bd5dad3c032
- MD5 1900efbf41f8bb57151cc942ef2a1222
- SHA1 8afa01360292efb640900a6cbcfad40b7f815776
- SHA512 eeccb907965099846c684fe1584dab1cbf74f0810ac89806827d85f0f456221fd42f0ec27197e9314a76e3980f3e2ad441d889a6d7af042ac8258207bfec46c4
- SSDEEP 768:JrGlacqrCJ6PTbIQG0mVdrxzMBnW+e9z2:Jrf3CJ6fIQG0kxzMFW+az
- TLSH
  T1E2134B1657E8C326F9FF0BB069B0E4954F76FAA26426D61C5C8D605D0C777808B223BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  windows/bin/service/Microsoft.Extensions.Configuration.CommandLine.dll
- Size 24KB
- SHA256 688ef791d4bb2e84839cfb28ec83772d561d958f6d0b20ca28be1c6efc9ea5f7
- MD5 2ebdc0b72eafb372036911dbf7ea1a9e
- SHA1 b4ce3f14ddbb8c0188c2f0b2f735512f3789df8d
- SHA512 82ae8f62c6ea58eeb54e116e8258db90db55f6c376ef572f52b580194d5974ad66cf1c62b329a322d681a937a4214b67f9b4e273335a90db662f3d7c55bd0517
- SSDEEP 384:4+6wnFbhCxwXaHsRJ0eDKfW9/nWCTb2HRN7jSR9zrZV:z6+FN04IcCSJ/i69zFV
- TLSH
  T10FB25B5697FC4217FDB70EB0A5B0E5452E39AB93AC21E62A185EB10C09B37804F7173E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  windows/bin/service/Microsoft.Extensions.Configuration.EnvironmentVariables.dll
- Size 20KB
- SHA256 797b3034fd173caff0850cd580428a5f4aeb7da27bf03369ad7f2b0996019399
- MD5 5636d243d19d4d7506cb8844458c3bdf
- SHA1 4575623dc6fc5c43718657e9c775cc2b48830155
- SHA512 b2176fa42bb1f20477102a1119adcf7b11c7e85dab1b5e6c937c5dd94d9e3068d8bbed7326d5c7c78a81f4705d3916a9d807e2522db75ea8114c05d52e55fd09
- SSDEEP 384:gSz0UpsW+K0ihWQS9WUPeWVC5kHRN7/NNPR9zbKmhBP:gc0ULPUrVD99zbhBP
- TLSH
  T14AA23B8593BC8202F8BB2B70D6F9D5622C39FBD26811892E155DF10E1C67B94CB61B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  windows/bin/service/Microsoft.Extensions.Configuration.FileExtensions.dll
- Size 27KB
- SHA256 acf5896d0f34fa1a43295797584b3805c24743ce25ee87538eeec83b012bbf4f
- MD5 286b788d46e6b5379db22454b505bb7c
- SHA1 43ccaf65099f28cb93716dd9d16f0ed4043b35c9
- SHA512 430b62f8d74bd28b0eb1e80a6f956c82a1e57abde6995152cb745a619bdc872aaa2b5fcc0f4b2b5bba35d3b871604f911eeacd21f97d478cbb5cb8542be8ebbb
- SSDEEP 384:U1LlqiKysfF+LY9PLIMXABPJqWqH6WIdX6HRN7G2MR9zFTY:kUiTQnwxsstWGn9zF
- TLSH
  T1A7C25C1287FC8213C8BF1B30F9B4D5465A35A7D76811E56E599DE00819B33C09F72BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  windows/bin/service/Microsoft.Extensions.Configuration.Json.dll
- Size 26KB
- SHA256 15e1262880f263806a2808d750688739662323b20ccd9835222fff8c30899a4a
- MD5 38eeb1691c133b414ea2061720c574e6
- SHA1 263001a6a631974cf87c908a058941af79f5711c
- SHA512 550404cd20978d8607efd5ccfda035f77b48e40a272f95323fe60a39c029d71efdf63999770ad221cadcf1ed5d9630762164533d66b9bd5e9f4146eac35331ee
- SSDEEP 384:z6J1o5QgFMvUo0e1l6QUWkWJ2WFYA6VFHRN7aU9WR9zGZzP:k1sFMYhudFClA9zqzP
- TLSH
  T18BC26C5593ECC327E9BF1F3095B4D9452D39A7C26912EA1E099EE14A08773C08F3271A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32