32ae9b8f1bf4f4f37278ed7a47416e7e9ede4a7075af4a849ce8a07c04f810e6

Sharing

Copy URL Twitter E-mail

General

Target
Plasticity_26.1.3_Win64.rar
Size 284.9MB
Sample261015-1kldeady8k
SHA256 32ae9b8f1bf4f4f37278ed7a47416e7e9ede4a7075af4a849ce8a07c04f810e6
MD5 20d73eaa9d1e5fdd11f792d0bbeb9997
SHA1 fa03a609e1d79d164df8d6b6f17412f83bb90a1a
SHA512 bebba347143c61cad2d0a147b5ea1e4cbe1dd5831feb30e089e3a2eef8214841de5656020139ff79f5c0e3c677c55b6469a809b9e9009406098ef83d32406632
SSDEEP 6291456:DrSBAH48WK9GU3KW4kCBoRMiTG/ixvO/B6l8v4hCBv/IZejZ:DemHjWFdbxGRMiTVxa6l/6Qwl
TLSH
T16BE8334413E59039F62B8F71EB8B9849E3FEF2248D25B87FC5115BEF1A642D24491AC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Plasticity_26.1.3_Win64/Crack/patch.exe
- Size 417KB
- SHA256 a6b38c1ceab1dc64a71f2e1e1499ecad4a2da577cf0351e2394773c46604c144
- MD5 778c989a3f72a1896f4957ea082fb856
- SHA1 4e016360532d8f90c38ab6cba96fc4172ef767c2
- SHA512 79604812975d0b65d7c3d3ce79aaf50fd5b1ac077c755897e6608846e769dd1f330d4fc3a522966e5798668e3c31c64c887d470f73794d04e341ced8a7a1f61b
- SSDEEP 6144:vELXXsxupZoetSwGl8CfiC22TdHT0RoR7LITf:vELXXsxuNcwovrh0R3Tf
- TLSH
  T118942893725063EFC82B4731E8C7445277767D7683A32EAB1294B37B0D713219C2EA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2
- Target
  Plasticity_26.1.3_Win64/Crack/patchfiles/resources/app/.webpack/renderer/app_window/index.js
- Size 6KB
- SHA256 d4c19a2676986c6cdcfd27cf61f599c17798c0b0039fa5ba4f8eb0956af301e1
- MD5 36c13fb4fbb025b4edbd3856fcc8b1c8
- SHA1 25b23472e9397b784a72459ec662de2d83856ce4
- SHA512 fda3ed81e4a0fbbc4b68f44a59654dce85ddb8d23451f514e007af68669adc8223d262ff0b5605e3dd04a98320679493d10442e1082464790494664acc98ddef
- SSDEEP 192:10hgA40Ujjbrdykk8QGP5Ft+Ifd1S3kFV59ItMI:a4Njjbrdykk8QGP5Ft+i40FrOth
- TLSH
  T138D1D8C827C4A4BE27B6A4D4C1AAFC1B72F64064302DD450D6CFCCA77BD188C8567BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Plasticity_26.1.3_Win64/Crack/patchfiles/resources/app/.webpack/renderer/app_window/patch.node
- Size 122KB
- SHA256 d732146cb000861752be17520b6797904fa95336237fa8197babd26627a72bc3
- MD5 4866e6f1cb7d8855a5e2f9cb46990afd
- SHA1 f0408c050b273861140253c20c9f962844119309
- SHA512 596d2d1f2397594c041d1a53bfe261c4b2fed357fbbc827d27786cb65d1aac85fdfff7ce394566e6823409de59ba8accf8d635ed4ca21c6830798bf6bffe0cea
- SSDEEP 3072:fEc/p2sm6PvU6JiGpUQbA+PphQJcc/0Db/hgUMUU:86mCvU6AhMA+PphI9Q6
- TLSH
  T173C35C5767A500BBE6B68234D9531A0ED7B678126720CFEF0390425A2F633D19D39F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Plasticity_26.1.3_Win64/Crack/patchfiles/resources/app/.webpack/renderer/pk.node
- Size 20.9MB
- SHA256 f027a0e284628f14d2bf86272b8b879aa3f329311e1940906ba76cbccaedbff9
- MD5 f6e905e6f634c96d12730bf5634495a4
- SHA1 754ea0bb5075a855f907cffdb6d83c225cb549f2
- SHA512 e0a8a857dbf054aa76c136efe7308a1f0cba6014f03d9ef5b82f0274190328ec119e68284ea04c478508dfc6f60b8f89ccc5bbac1e15b82224eb95b3993ce91d
- SSDEEP 196608:tG0A9vEGWU/4DoxmqWMIk3+lS669Ia/NCZDTfNbfLMHWOBCR:tGb9v+UwDocRMIkuwnIa/4RlfLCB6
- TLSH
  T1C6275CE630E056D8C4BAC179870BE927E66B34550335E7F700F19A5A2E26DE1F63EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Plasticity_26.1.3_Win64/Plasticity-26.1.3.Setup.exe
- Size 274.0MB
- SHA256 dc77e9695434723416c290c0a0f5dad0c0dea8a2c9274f03a9d82b2f5c9fa55d
- MD5 26b3677ae6b29e233ec22147c9bd2022
- SHA1 3bbf13d06f550b5d57c8a0b0c08b05e687a5ede6
- SHA512 b0be48c16fdc5189f94eb5e80101ad38cb9b61174e1736aec87f62862d38964b416c105b97b56242f36b150a4dca3d5762e7548c76120799688bd708cb7da975
- SSDEEP 6291456:sBAH48WK9GU3KW4kCBoRMiTG/ixvO/B6l8v4hCBv/IZejS:smHjWFdbxGRMiTVxa6l/6QwW
- TLSH
  T198D8338463E59039F52B4F71EB8BD889D3FAB2248D25B87FC6115FDF1A582D20491AC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution spyware trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9