24b179fde26b8263401968e9deb4993b6b28356d20a465b410574f20c79d0e74

General

Target
BUG-Clicker.exe
Size 107.3MB
Sample261024-vxa6babs5z
SHA256 24b179fde26b8263401968e9deb4993b6b28356d20a465b410574f20c79d0e74
MD5 945942d34bf191fb769d7d04c5c0d404
SHA1 a6381ff1ae81effc493e28158933029691034768
SHA512 53a36ec9e8683b594dcef2316755b57f9b3b087f63c6b3cfff23f8c6f1adadad5220004e516ddd8f891e68dad0aac27c9fac87d58f4432ae2b0aa94787c05fe3
SSDEEP 1572864:Vrz1hs6ZSO8A69j5SJNDgdsd8nYLnw2ecZd4QYcoaiUtxL3IEr+6c0S3T7:p1EA69jYDgZnYLnw2RXgvcxj3RM7
TLSH
T1FA383309733276ABEB61E6E187ADD8F6AC751B6730A9200A135070225C17EFD7F4F582
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BUG-Clicker.exe
- Size 107.3MB
- SHA256 24b179fde26b8263401968e9deb4993b6b28356d20a465b410574f20c79d0e74
- MD5 945942d34bf191fb769d7d04c5c0d404
- SHA1 a6381ff1ae81effc493e28158933029691034768
- SHA512 53a36ec9e8683b594dcef2316755b57f9b3b087f63c6b3cfff23f8c6f1adadad5220004e516ddd8f891e68dad0aac27c9fac87d58f4432ae2b0aa94787c05fe3
- SSDEEP 1572864:Vrz1hs6ZSO8A69j5SJNDgdsd8nYLnw2ecZd4QYcoaiUtxL3IEr+6c0S3T7:p1EA69jYDgZnYLnw2RXgvcxj3RM7
- TLSH
  T1FA383309733276ABEB61E6E187ADD8F6AC751B6730A9200A135070225C17EFD7F4F582
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  BUG-Clicker.exe
- Size 234.8MB
- SHA256 2ccb95d90abfcc79164b53b8df11bbfec14dfa329666771d4e103df6f49f7b0d
- MD5 eda690e3bdfbff69d712ac26c41f55ec
- SHA1 ee828be59b0367af6b47383bc8a927203602543f
- SHA512 a849f80401b6684be428fd123914d8eebd771dc7a241e35731735e349d801c41b756d9feedbba54a0fa25585cbacb35817be409387d932122928ba18c0aff89e
- SSDEEP 1572864:8K+VLo+Ek3je3+ZwxIPkVDTiElm6YLRq8wWGUfOBvLE+2uWCGlnJ4+hlRM1fw5d0:wode/hDZIaZ
- TLSH
  T1C5C88D03F29601D9C05DC1B9875A9633FE71B8494B25A3DF2B5447922F66EF82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral5
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6 behavioral7