9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25

Sharing

Copy URL Twitter E-mail

General

Target
GHXSTLY Tweaks 1.0.0.exe
Size 71.3MB
Sample261024-wfzb9awsd1
SHA256 9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25
MD5 e6b821da12cc011486f2ae5a023d3190
SHA1 82f3034d470ddf2ecb860c9c00ed2d99beefa84b
SHA512 b37ea74dc0e7420b22b229775bd6251f13aa66cd1ac40f628a2a4afbac3ed3ef2f710c038fc632e0413143d2ad286aa38d60de05d0c2aa2139c760cad99a8579
SSDEEP 1572864:Wt9IKPXbvqSuPKLjm4+HQMpNojc/68VYkisNMqhjCLA17:WUKPbvR4Kvm44Q2mCBMqhjCLA17
TLSH
T1E2F7334D95CC802BC46F5AF42AE3AB2251489BFD3D3B7C7A592C995C3F84991CCCC25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  GHXSTLY Tweaks 1.0.0.exe
- Size 71.3MB
- SHA256 9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25
- MD5 e6b821da12cc011486f2ae5a023d3190
- SHA1 82f3034d470ddf2ecb860c9c00ed2d99beefa84b
- SHA512 b37ea74dc0e7420b22b229775bd6251f13aa66cd1ac40f628a2a4afbac3ed3ef2f710c038fc632e0413143d2ad286aa38d60de05d0c2aa2139c760cad99a8579
- SSDEEP 1572864:Wt9IKPXbvqSuPKLjm4+HQMpNojc/68VYkisNMqhjCLA17:WUKPbvR4Kvm44Q2mCBMqhjCLA17
- TLSH
  T1E2F7334D95CC802BC46F5AF42AE3AB2251489BFD3D3B7C7A592C995C3F84991CCCC25A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  GHXSTLY Tweaks.exe
- Size 180.0MB
- SHA256 ee66b8026a7e26770b1e10ed9f125a6828e5c76f5ea1b9f113d4ea963a78b609
- MD5 15a34827a8d9b32e3a618e8b219d0306
- SHA1 c913b76035dff4b748fe994034f9304c73d9cc72
- SHA512 e32d1c2e9777545237b59e1524db9ee0da254d86dfb160f8daf4b44fa62a379307f058894f583819620f9067fac237f8d7ffb2d3c952ecf8c24e04d192723a95
- SSDEEP 1572864:hH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:msok+hK7
- TLSH
  T1B5988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral7
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral10
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar
- Size 302KB
- SHA256 f9a080dd2fe775acfbba66bfec036a36b41722e93a4e61286f2ae68ec8fd90c6
- MD5 e8d0478a201c750dbb06b6687cc3504e
- SHA1 ea6e3dcc9f83d6b4a151f84770ec28da97870359
- SHA512 5e5c5f72de3f9fc08e8f6125941a19d4f205fedeee8105c066c17381d890d1d93bbe77eee1ea20266ab7df410c48da88e5d3179ba234e5fcef907b74ef42ab63
- SSDEEP 6144:DTM6NgRxwHRAaVa4gtsLKNWxLuTEYKGJRZXSfn:fqRmRLQ4Q1fTEYjRZXc
- TLSH
  T1C6648D32B1B4163765B381BA688BA153733890037502A608769CA11C5FCBE7FE6F77D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit-x64.exe
- Size 1.3MB
- SHA256 3e7801db1a5edbec91b49a24a094aad776cb4515488ea5a4ca2289c400eade2a
- MD5 e0cb28bf051d6311c1dca32f392c7d5e
- SHA1 d210d5297a17a15deec1c19359b6f9fe1861092e
- SHA512 c13e7ffd60169c348e16a3ea59a171c1777acdb241f950c11a6e9b69c955a3a4eb3432182aee7f489a87a555d0bd51fde3b597826f7c1e6488f1f5097359ab4d
- SSDEEP 12288:FT8MNbCKEQibPsFC8KQiQE2EEKE3N47wLIFaVGO0B/FvrC0R1qKNlKbNbGEzET1N:vbCs3gfEQT1UtsocI/+c
- TLSH
  T190558E6A339812D5E1B7D17DC9968B4ED6B17809432157CB01E846EA2F27BF80E3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit.exe
- Size 962KB
- SHA256 38fb5e935d7cb58d7a98b4ed8f876c83f5db032bcd0329b0a4de4e4a1de876b6
- MD5 c5b9d7179c7e03f3af6695fda0279a03
- SHA1 ac8187f905e6bbf8d3e4679ad53b81ff622b4347
- SHA512 bc9c53736a8da0a2b05b5c19cd22069d935675ac1a7069a14e37af838d8fd336781fb4e5ffd1b3a5bfcf1807527f7770b92d6eb1f89f760826a844b8e9ba9f71
- SSDEEP 12288:0YdQEWL8KtMimRZs2w4bAe0UUK4EZG1v3bq+IqjQ3XxWue163s0tNGc:ZKEz5BZs2w4bAe0UUvVv37IHXxjtNG
- TLSH
  T117258D2178C08176EDE321F646ECF92546ADD0B0072A56CB56D81BFFE7306C16B32697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/rcedit/lib/index.js
- Size 1KB
- SHA256 3385ce0efbff05cb272b4760cab763f88f507a53c776e2df942991644cb6f20b
- MD5 c52b127d37642bf301941897a72da9cf
- SHA1 a35305d6d001e519505c544728132b614a633d92
- SHA512 7b163881756225a34ab0ed396fc4b0652ab41365fa7c512c98c68268fada15c808ed2240017d2f0bb34365b60b97f1424b26c09ed64b205113b01700cfcf312a
- TLSH
  T1B021CE0764B0167D07BB1ED7456F29206375C043B11998F1BB8C4360AB8653B8EF7F69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  vk_swiftshader.dll
- Size 5.3MB
- SHA256 409a0fa76f055a87ae70434414586d144502beb25fa3004866ee70abd9a8547e
- MD5 5633d5211bfbbbd2b0493fcbd492f5fa
- SHA1 9ad2466751880fa0acc1dc6af2693d975dd9e307
- SHA512 8eb5ab1ddb1dc42eb323a163af6b4521acea5194909ed39933710bf3fecec5f50f070c20df57a89f4528076fbddb0fa0c27de3faa7b4a249637be00ec3bf396d
- SSDEEP 49152:YaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+B:762naMskwtEMaQPJnymh
- TLSH
  T1AB463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  vulkan-1.dll
- Size 874KB
- SHA256 f6c99137c3d6af45bc2262815867d6d37f5dcb0552caffc90cd77fb6561b7491
- MD5 a6e115dcfb063d0c06f8bef721166b37
- SHA1 8a548affa209f561e7eb8f51d5515aaec8c7bc59
- SHA512 ec5715c005cd2bec8ef2ed5af16c041d56d5e1175342c285e4c2d693a88cc86bebe83ec7d59ba3c37b91f1b5e99879532aae9a7fe68fe7ab2c758d649e034062
- SSDEEP 24576:l4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKr:l4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
- TLSH
  T1E8157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Discovers running processes

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27