cef60b523befb928bd7185fc5a783e9f1a39ef6bdbe735a360f73a9634f9d712

General

Target
Krush.exe
Size 78.4MB
Sample261024-2vk13acy4w
SHA256 cef60b523befb928bd7185fc5a783e9f1a39ef6bdbe735a360f73a9634f9d712
MD5 f2c8b29ff342124143465daf64e34fe2
SHA1 b815a8b16d52ad4b6354e5cf0d6e1c0d6309b244
SHA512 9f64abd408ca6dad467fc7bfac35c07d2eaaaed4b87058b3d21a2c3fd927cdb3d566928cbf501294f4557d57af22640f9a4aa7c2346b7b3c57da0beeb4cef62d
SSDEEP 1572864:Naa8pP5IxYbmi9Gb+WcniG0rma7fxAh9/lLRnEVlnU6oOLIohQuS7:NaTP5IDbzcdI5S5tuOH2hQd7
TLSH
T1D808338B190ACD64DA0D0ABF55E499504FBC6EC29C92F6B3B3E941FC37E5240E784B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Krush.exe
- Size 78.4MB
- SHA256 cef60b523befb928bd7185fc5a783e9f1a39ef6bdbe735a360f73a9634f9d712
- MD5 f2c8b29ff342124143465daf64e34fe2
- SHA1 b815a8b16d52ad4b6354e5cf0d6e1c0d6309b244
- SHA512 9f64abd408ca6dad467fc7bfac35c07d2eaaaed4b87058b3d21a2c3fd927cdb3d566928cbf501294f4557d57af22640f9a4aa7c2346b7b3c57da0beeb4cef62d
- SSDEEP 1572864:Naa8pP5IxYbmi9Gb+WcniG0rma7fxAh9/lLRnEVlnU6oOLIohQuS7:NaTP5IDbzcdI5S5tuOH2hQd7
- TLSH
  T1D808338B190ACD64DA0D0ABF55E499504FBC6EC29C92F6B3B3E941FC37E5240E784B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  Krush.exe
- Size 201.4MB
- SHA256 d6b2e1e101797d99ac38c2ef4b126544d541b8b307ee01020e7753d1d4ac0096
- MD5 39b5cccd250dd896b0203518b7b558a1
- SHA1 e47b0597fa88fa4d72e9d6901ba4edbd85e7c879
- SHA512 73ac873509cc053d2390dbaeb9d05eb25ba225318c1e4161f568247e16b2711839ed3f3cc6cef723f0ee5e4b8608cfc402760000698d5207095f438f2bdbc02b
- SSDEEP 1572864:LjO3d+HTPc9eDaxayId+tUcbGxq+TA5htqiQNvF1rtVxa5XLmgYtVHbI5op/cObb:3OISeEyNRqVOb/ZUmLg
- TLSH
  T14BA88C13E29641D9E05DD175874A9733FE72B8094B28A2DF2B5407522F77EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral2
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3