2f9b740d5d686506ac9c3f222c0a8c79d2a7fb880a85edda30d8b48ce3c7e217

Sharing

Copy URL Twitter E-mail

General

Target
RuntimeBroker.exe
Size 86.1MB
Sample261020-vr9rpacv41
SHA256 2f9b740d5d686506ac9c3f222c0a8c79d2a7fb880a85edda30d8b48ce3c7e217
MD5 2ad5806e3da50e403e9a8074ab02bf40
SHA1 fc7c24e37ea8f3d5d47d8af4c3b47c2328cf8a8a
SHA512 5f31b5644ed666eb0143d86e4237df8ab3fe4874a5814989ca6fd9141763128f3b34421c01eae671bc2b46d42723181db4d9f6bd3ed1e8fbca4dc98f118cc245
SSDEEP 1572864:2SnyLU23CkXdnBlmVGXp43IhToK5RYe5yaWJVJsUJCIDF6/M47:2eyLUkB/BtUK5aeNW3J/4/F7
TLSH
T1B5183339C27A9EF1D3C4F6F0D3E34C0BDD8989E92A01593CA3A1CAB99FF5D850998511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RuntimeBroker.exe
- Size 86.1MB
- SHA256 2f9b740d5d686506ac9c3f222c0a8c79d2a7fb880a85edda30d8b48ce3c7e217
- MD5 2ad5806e3da50e403e9a8074ab02bf40
- SHA1 fc7c24e37ea8f3d5d47d8af4c3b47c2328cf8a8a
- SHA512 5f31b5644ed666eb0143d86e4237df8ab3fe4874a5814989ca6fd9141763128f3b34421c01eae671bc2b46d42723181db4d9f6bd3ed1e8fbca4dc98f118cc245
- SSDEEP 1572864:2SnyLU23CkXdnBlmVGXp43IhToK5RYe5yaWJVJsUJCIDF6/M47:2eyLUkB/BtUK5aeNW3J/4/F7
- TLSH
  T1B5183339C27A9EF1D3C4F6F0D3E34C0BDD8989E92A01593CA3A1CAB99FF5D850998511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 b1ac2fb5c8f0407ec73ffbfcff46aa634a3acf034eb10ef3f69cf483f43e591e
- MD5 a6788c05c8f55285267442473bc145aa
- SHA1 a19630a8a0536a80f095e0be19b5a21b9f8b7945
- SHA512 c7125e3062ce1591a646424e6f7fca36f0559cfe37197ad10f74415471916dd6d386b8d3f9c15accd43f678777b8a6f7c515be28f13b97d200942e5f13191d90
- SSDEEP 24576:c4QQf6O36j54wRaXe1Vmf/6k6T6W6r656+eGj7/4po:xseGT
- TLSH
  T12CA6A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  RuntimeBroker.exe
- Size 177.7MB
- SHA256 7d90c0755e51a197c205a5afd2b7992c81b008663c86b8d7660e3206717e53e2
- MD5 f0e69fb488d5bf6ac5fa24a8997da834
- SHA1 2c29d4b00e8ce83180d5084ce47915dbe634d9aa
- SHA512 d405bc3a2943799d7efe2f81ffa0887fb2eba2b23f1a4f3de730eed264676c5c13dcbede6b427406b338c5df1ba404b8055a3073e27836547e5e22c139282db3
- SSDEEP 1572864:D0ORTnjSB/Ttde5oe7JyhLfYE1xX6BSgj7zIH+r4VOv1QsiLBRzDlJXlSubMXEsZ:MVKQxx9
- TLSH
  T1BE989C03F2D610D9E05DD1B19B8B9633EA72B8464728B2DF26540B562F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 94efdb523162f7a55884f6bc423012f3dd046f85504deccfeef59603307db71b
- MD5 5253864a60577a0aa98db449cd7c6440
- SHA1 f4423def8024c5015367747c624d035a214ef49d
- SHA512 1af68134a381499134240d9ac42874005012127a81ba77ac3f1497509ba298bd092d7a17e49ca831865034d716ff156186c5547dab1ab8484431bdd1757baaef
- SSDEEP 49152:/tOSF+Xn6Rjc8E+E4Og1JytTbEcS2E+X6CftBJyN/4O5Isy:/t9cWOgTyZxzZO/V
- TLSH
  T166D5BF03E6CA50D9D029D071979F9223F631344A8F2567EF16905A213F6BFD82E3E729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 473KB
- SHA256 c9f1fb6b4ded3404ad29e629874ff05852f48f82ac33ba606847cac0ebef79e4
- MD5 cc528ba62f3867b7ad803ff22a6e1c08
- SHA1 e13118e48060a58bff0f8d5c8394a3ff7b60cc95
- SHA512 79f74d6f951624b3f8575acff6612aacae1e9f3e32b0abf9ea9688887666097429bf35d8eedf9ad3970a30957696eafd747020c6bebb76e2fd9b2d2e8526e0ab
- SSDEEP 6144:f5M81DtTHzR8J6E8cmqLD0x9cDEZAw6wu7fPbAT1TAswwdph:BMkBB8JB8cmqLD27ZOwu7fPbAuZwdph
- TLSH
  T1D0A48D1573D444A9E06BD1708A574643EB76B4920B65FBDF02A092392F7BBF89B3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 c636de2892cb651220331734ecc578003dfe31f6ed528ffffe66370b2114b086
- MD5 f7aa9fea497e88d41e61cd5090bcba53
- SHA1 54a9f86943d1c496d3a73dc888c39df7830194d7
- SHA512 6adf7de3f6462b15c7ccec8d4858d30f3cf042dd5698c248ee371b750896c222f7720c39b787200136eff80438d0fe977d1278f49aebb90d19ba9ada79175861
- SSDEEP 98304:6nXvuO/so95HjrmniuxV0OADYDOnOQP7sG+XC3OT56:6nXvj/so95DrIpgDfnBsvmOQ
- TLSH
  T156867C03F69680D9C04DD2B8975B9623FE3178990734B6CF269017292F77BE06BBA714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app/capture-renderer.html
- Size 5KB
- SHA256 1efeae0e6aaedea9b3f78b4f88c28511c40a23d2d1dd03e511fc6d342f849383
- MD5 8a5c44e899d5d9408326dd17b2e087c3
- SHA1 97ad1914616e6c35b2a98ff99d44700bd07befc6
- SHA512 9da987d061a1e71bc1d16be6b720ee8ac78ddebb6d0fdb5c4d9173be312dc308a89ba689fc74b33a93d3c7f7d7a22748b77e4e5122c33209dc8bf62d8461ff4e
- SSDEEP 96:HtFqyytjFReEb9vj5a5XwIB1fC1hKKUlR4+M5a5X4IB1f8rUCz6Nk7v1QORuDFlP:3qyytRRlj8OGi8VfkT1SL6CpOCnz
- TLSH
  T149C1323912B92427A603A07D6E575305EB72F60336075A887E4EF2405FEC63942B9FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  resources/app/main.js
- Size 2KB
- SHA256 34f4a459b89504d966c7d5debc2bcdf9e6debef7522ef44ab44964f633e0159c
- MD5 4d085f871c707cb43267af2c3d84a64a
- SHA1 a87a354fd6bdbf9a2bcd2d59e37ec10901f5bba1
- SHA512 d28025125985aa536ea5bf1c6afc5792b266346c7c1391acc61a10f32503912a9368dcf02757d9b48331df11aa58c7d46e1a4845a178b7fd549f948aee878780
- TLSH
  T13C511CAECCA9613E4A1BC458DE135243EB2BC503500866EAFB0D536A9F90159C6B1FD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  resources/app/node_modules/accepts/index.js
- Size 5KB
- SHA256 be2decbd50610e8f995c1e312ee4dd6d7c1244cfdf03ee4c4a3da68e572dada1
- MD5 4fe4d2c90a2fd19d6e97443a7d24f815
- SHA1 282263f45f6bf80fbf43f4097d53b5b60ff1a05f
- SHA512 c795b7285cc92616a46fd1ad2d00ce65fb4b269e6b6fc35315891d119b7c25b7f4573540be0627d577123201d9cfe119c8a53f0e75a8b6ea870f8d89a130c213
- SSDEEP 96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9
- TLSH
  T108B1328535DAB096974310B09ECFE749F035840B312BECA1F19D73B42FD1EAA8255EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app/node_modules/agent-base/dist/src/index.js
- Size 7KB
- SHA256 13b6d658b492796461358e19fe1de30665ab2efb04c726b82530352cd364d4ac
- MD5 1bfcc9c7404abb4832ef4b8929b707a1
- SHA1 eb7241164e557b1a9c3c5636c60e3956b3aba50f
- SHA512 08e5f8e2ac8d5cf661692f6df646509141196b01187a8fa18477a9130423da5cdcd6df81c699e4b792e0c91cab6f6251825dc9bbe63101f62a1ca0d1c63bf2d2
- SSDEEP 192:40xfSCxtBtXysbbsfphlknf7GsMwf7S4t7N9nISMKoigiBJiT5iUW+kOWmFxTCyz:iCLfoojWpkOWEJCtS
- TLSH
  T1B3F1964D66F7A0616033B6AB9F1B61867B3CD01B9608DE94391E43F49F422309BE1BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app/node_modules/agent-base/dist/src/promisify.js
- Size 495B
- SHA256 7db1e28ac19b38be8cf3edecac66c7084bb00b65f6755a83309bcf10564b5771
- MD5 06aa69af533abc385cf197f475be91c6
- SHA1 2930048e0fe75b88d2af102698d87d386ca13d33
- SHA512 a5e450181464ce1a585fa695ed2c68e422eefc2f6d7b64f1f89b99922745d92a47d6ce7fe3a7a4cacc98a0a389913efb7d4a10d0a9b52529a4c2e31615e5fdaf
- TLSH
  T100F0920EBDF2D5AA5263B8AD524FD04AB219A503602CDE247A9C6B604F11974B9A0AA4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app/node_modules/agent-base/src/index.ts
- Size 8KB
- SHA256 63b9c52366354393361bbbd40158a3051d39a6e2db4ce564418e01e4ecd1bc64
- MD5 47884533003714b71354019863eb558a
- SHA1 14976c8b604c00cd402f942dfd773b0f052c74dc
- SHA512 e6a0096a18c8118394327ca6297737e5d2d6dd967587f9899ed6ca77c706ab2aee4926f62c08b8278a0a7d8627c12a1e9994e0f09bc58adbfb2543f29899811a
- SSDEEP 192:u0ykZA2pfztaIiN2oZTJl7CA7ncZ0IK/j1KXaEBUijZCvszVQ4B1XvzIn1:7ykZ7FMII8ZBBUeCvCVQ91
- TLSH
  T18512C7CEE36FA3665570BA47CD3866CAA27CC4229D085CFB7C969AAD0653318D31533C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app/node_modules/array-flatten/array-flatten.js
- Size 1KB
- SHA256 766ca145b6d25e3d60f352a716e8fa1876bcdf362c0767c360cf24f335bc281e
- MD5 4b17fa06c54846b686b8b799e9dd253a
- SHA1 fc6cc30e8b8ec09eeba62bac076ed627aa3ee8d1
- SHA512 72df1668f464f6942c484155b667086bb6f83f77e826ffcd146ee045079db3334aba270bffb66cdd796d4c9308121ec2a67a404289f19914c45d9a6c15435e71
- TLSH
  T172213AD43DF3302E53077830A1ADD4C5D1A84813613F9A42D10F6F602FEA830666D9EE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app/node_modules/asynckit/bench.js
- Size 1KB
- SHA256 b6c4a058c4fd03900f3786ef216322d57553ec83998e19b6d557dc39acfd2f9f
- MD5 1f35225bb5de1e68d061869daf5d5ae1
- SHA1 8dacd95640ad3d0ae47aebf5bd1ba4d83f6a1f1d
- SHA512 18f7ea15e4d492bf65cb28d5cf3cf991f80d0a00a82d53afdf089d45c6e3ab9064ff9a12e124c8b0202fb640a200b72b62166c675d6e1557fc4a8db5c1a70be7
- TLSH
  T12F21AB4815F23270A1373679872FD56F72B38943181C9862B99C81C60F9AB169827EBA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app/node_modules/asynckit/index.js
- Size 156B
- SHA256 397441fd78b69d7bdaaa48a0f354c8d07086a24414655b0601ab4f0c26e15f2f
- MD5 80916e2018297eac89a0765e9300ba11
- SHA1 9201eacd2650642ff12a8af5fd1dbf7dc7848bee
- SHA512 41c948693ff71feeeecc31fbfb4b210231a9da914541893dcf76522a301a3ab6a7109393e0f7bdb916aae817b573ffd521d4f32f44c166427cdb7139565b5e9a
- TLSH
  T169C08C871FD066052203AF84D6400B283122E407410C39A0788C349D63C86C80F24E9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app/node_modules/asynckit/lib/abort.js
- Size 497B
- SHA256 2c64e26dbd17f4c5ee9e017a098cda40e5eb2234a89cfeb46287f6378b74a66a
- MD5 884f70260b904535b3b46bca66d3901f
- SHA1 440629b13ff27be58720005cb549f38903d80737
- SHA512 2fb2e2b5548da581101eef16ebb201e0d03d54d28b0ceec2bd0f46b3b4a776358af6068323da64c348a4c553dca31cddb5bb4f45db6fd173e54aa5d71088bb61
- TLSH
  T12FF09E3BE121B1278D2B6870C58F54F8AB5F4265E263E9462446DAF80E2C03A064EC24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32