4422e89115c28f275fc729f3ae3c53981db0f6944c21ccdc1de5977844efc797

Sharing

Copy URL Twitter E-mail

General

Target
Muriel.exe
Size 89.7MB
Sample261026-rwlc4sxtbw
SHA256 4422e89115c28f275fc729f3ae3c53981db0f6944c21ccdc1de5977844efc797
MD5 5c47fb1ad7d86f5e320d6089177bd882
SHA1 300e154985707c7d44484cb9e9d9eb57652d26f8
SHA512 69d84cabc52161b6b697d48f1c293a75a67e99248e921fb29934307fa236ab364dbb52856f85bb7fc6fa2263bc8c7318929dfd7a9402007caa532280d0feb20a
SSDEEP 1572864:mDg887MkgLHuxNfG2Q40fUvVL/Bdwsrpjm5TSGkshRhn3ME7:m0hMVHiNfG2t0fUtLxFj0S0n3ME7
TLSH
T12E283376BB5E0AA2FFE0C37F211204932608379A0F59E3FA5D1498DD98487BEF825C55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Muriel.exe
- Size 89.7MB
- SHA256 4422e89115c28f275fc729f3ae3c53981db0f6944c21ccdc1de5977844efc797
- MD5 5c47fb1ad7d86f5e320d6089177bd882
- SHA1 300e154985707c7d44484cb9e9d9eb57652d26f8
- SHA512 69d84cabc52161b6b697d48f1c293a75a67e99248e921fb29934307fa236ab364dbb52856f85bb7fc6fa2263bc8c7318929dfd7a9402007caa532280d0feb20a
- SSDEEP 1572864:mDg887MkgLHuxNfG2Q40fUvVL/Bdwsrpjm5TSGkshRhn3ME7:m0hMVHiNfG2t0fUtLxFj0S0n3ME7
- TLSH
  T12E283376BB5E0AA2FFE0C37F211204932608379A0F59E3FA5D1498DD98487BEF825C55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 89.3MB
- SHA256 0e23674c1cc8ea40a8827132184cb35c391033c9f754e7cd90ea99cccfc342bc
- MD5 9b03c5f14cbcb90f4206fb81509a4b62
- SHA1 68dca46f382259c15fb4ebd11ea7789bbc6bb0ab
- SHA512 92cb67ed3d000d43e3265733eb5596d9265b83f090c4b0c6f9631c5713cf5b7b853ce178f67fcd01526a408092b5dd11efb736b76b0fad95bd72bfa3a7850d0f
- SSDEEP 1572864:/Dg887MkgLHuxNfG2Q40fUvVL/Bdwsrpjm5TSGkshRhn3Mq:/0hMVHiNfG2t0fUtLxFj0S0n3Mq
- TLSH
  T12E283376BB5E06A2FFE0C37F301604932608379A4F59E7FA5C14A8DD88487BEE825C55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  locales/pl.pak
- Size 696KB
- SHA256 f92f6bff33a975e189b78a4cf0e153e85743dda432347745ebf8f1b4ff51a99b
- MD5 833780b94215f9ce32c35724c8cd433a
- SHA1 5c6ae41a85dd10d48480f96e9a49d047a2786071
- SHA512 e428f19759b6e88e06ec7913197e7c6f8849b280993ccf1ad0ce61d92d92415ae5819f88e8c0b352110034a2cef89d9c9936dcd52d89f26c88811e8de015e8f8
- SSDEEP 12288:ma43m2VnK/owZwfQfuzSJabZpbn6fPPCUdUe3m/UevM/mE1QhrBajMol5/rT:FeHVc7K64vMH1QhUv
- TLSH
  T1C9E45C0E56E58A4E8CA008E6F6E70B7CACDDC808F108D35FE46F4526719B19EC9BE5D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  locales/pt-BR.pak
- Size 652KB
- SHA256 d1aba0dbde99231d3096b7ef9ec62ed017c72804257de62ffb649d45cf234f9d
- MD5 c4113071b2f5f681f5f67da835bc6a94
- SHA1 e79b1944deb0f5de2841821414e8c3b522493a88
- SHA512 5d32321684ed196730a64d6efbc4072abeb4f866bb38ff7284fab01e4de9ebcf4a65a4fe58be6fbf3687671ee566c2f63d2eb64d861d6d6f60518864dfd6e91c
- SSDEEP 6144:kzerJK4F2WbuNBXBLEpPQHEyWAEIIr9dqsRUUf8n:kCr1F2W4bERUsRDfc
- TLSH
  T170E41C2A6ECA136605229350B70EEB47E5890745FE06DA87DCFF4F05A3CDE40D933AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  locales/pt-PT.pak
- Size 656KB
- SHA256 1326efcde830a8b29541c98fb51e3b5e5428d2a59e1b21a11a677317d08b2bbd
- MD5 1dd9b726938cf1c514fae6e7f1857243
- SHA1 210e2f56820cc5800498c76d2aedfc3c6c16e5f8
- SHA512 ae7b7bef5ce73aa330ea3baa5e10cc73102f3e871ca4d7013b72f7c36a0876b17f91ec7b89a8f8ceef2dc222f5b3ce12f46cae410516ec351331e5d60cc7a2ce
- SSDEEP 6144:Oc2BKdzn43xugTieJVJJxhuI9AyN55frKDn7t2leSR9J:d0Kz4/EDn7MeSRT
- TLSH
  T1E9E429296EDA132605135341B70ADB03FAC85655F80ACB87C9EF0B4272CDF94D6B7B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  locales/ro.pak
- Size 681KB
- SHA256 7fd5b85509f67394eee48b07339c9a3a77fb1fb99b6204bae3209f9f0ffab3b1
- MD5 619c48fd2e1320cf840dfd9db7595680
- SHA1 9e97815bc223d7805f335adb209504857a7ceb1c
- SHA512 62abc32152c161375a9986dd350940eb4efdb5c8b246c25f0995b03c4af446acbbb4ecf8e7b94bcb4854a46e0740fd4c260b12836a41e123686b96014f2309b4
- SSDEEP 12288:H/INhX6pzClnInPBiqTL7uIQH5n9le/zf:H/ITXJ59la
- TLSH
  T102E42C23A1C41A972D5152A2F73A24D3E88E105DF641E2CDA4EEC97910CDDDBC52EECB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  locales/ru.pak
- Size 1.1MB
- SHA256 23166d431d70048e248e3ff47732642cb1ab73f9516384e33ef3c1979574f2ff
- MD5 68dba8cdda096e46a95ad54a881a2511
- SHA1 34f59329db3af2fd40c8832e9c512cb6ae5de32d
- SHA512 ee2fb972e357a3383b468220b7697d1af6d42d80e5b524b0589f74b69aa08eda146529538cd5fcc8c10e93dc9360bf6f57abbeef217b901fc8e7e7a140d1d1b8
- SSDEEP 12288:znSNeJ1fQeRo4YeWspkzJ9sF+oa+ULZHo6HzW/oqSvgsGCZkE0dR3Q8NiGjhnYH+:znSNklFd8oX/
- TLSH
  T19E358860669E64DE1101F01BDD08BE0D3CEB45FE3FAAA35219A42D7F35F2024C67E65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  locales/sk.pak
- Size 708KB
- SHA256 91037f2ecb636857b92a2729b7c116d8dd98082b068e4f78b0fdab06f27d2eb7
- MD5 4515aa1557ede9054727f1903a32aea1
- SHA1 2a0b1bbf8ebba75bf03b6ab0c973987a82c87c09
- SHA512 f05107b6bde25094197d4cca47847b9893eef96de57e80e352517fc848da0680eabf0a85b801570b287ddafa7851fd79a8f15672ada3e863ac2a3deb1d79d242
- SSDEEP 12288:OKeYc+T27pkzA8+mi+xdnaOY7VZ8pTjsxt9wF:Og0pkV+mYL/taF
- TLSH
  T1D1F45D3FDFE7181E8E8D0108FFAA7110FD6E8650864EB4A6944F364714E26EDCAB4E54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/sl.pak
- Size 678KB
- SHA256 321ab341e3225dddcac858448367d43677c20e739b2ccab52f8c86aa0727d868
- MD5 c8b796082609ce19f54b51e159514e93
- SHA1 5d9c961e0feb6b2c96a7ae07ef24402e714a743d
- SHA512 188438e92ae501ff767dc7b582ec1c5ec07e896db8417a4cd19e3933cfa97b1f2b5fb1a68a165b5057f0ce8b837ecf81bd76e8da0d5ce36d09d2952716e68d21
- SSDEEP 12288:eIyYXpvc7VcB2+RVWobUWH2nWOq9pwi/fzB7aql/ad:eIyYa7+WobnH2ni/fzB7W
- TLSH
  T146E42B397EA74E0F0C9AA2CEFEA606007FDC044CD256E6A1EC4F33795415A3827BD595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/sr.pak
- Size 1.0MB
- SHA256 7b337dcad390a9f08c3bd1d27235898e588827fa8da8808f4bc7012011578ef0
- MD5 43e781b3ed61cf95fa67ae5afadfd6e7
- SHA1 e9f11f12488172918495d841d4acdedc0834ec9a
- SHA512 cf458a74cbbbca27e0ccfa9242dd863a52cf3a0fd5e84e610f78b9b18ff7c921908fe98d824a3211b4061a63bcd0494b857e4aa8d2f3f74ea03af54cfc478190
- SSDEEP 12288:C1+VkxNRL58I882S0dRsCt7i4O5JM9kpCQhW6CgxmIF379juz3/k/Q:ufXqICV3
- TLSH
  T1793556B19B9E64DB0501F41BD808BE493DAF41FE3FAB975211601DBD34E10B847BA29E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/sv.pak
- Size 605KB
- SHA256 f10b4db7184a14f28bfdad82597d2d43b4ec859ab6eab59a5c3891aa6070f3ed
- MD5 d1018c51fdea57efa44f5ae01f749f3b
- SHA1 f17ff0e7a902c7ac735ca4f51c4206ab7a21fc7e
- SHA512 6602ab45ea2c3ea76127de42788640516bd0532e7154673dc9da76c2845e1636a7b77658aa52fb7b6fdafdc1e55719138f4a483d3c5830677c94ac6fbaca4e63
- SSDEEP 6144:NlqVqEHIL7xbjCAq0C9Q95YVgyLIuxRxhVbFl14hLOVRFcz5RtGm1eqMlmFMCOSG:NlZL7MAqMT8xj4iYF6b
- TLSH
  T1D1D42C438A20F526FAB2530DB608115F0AEDE15CE7F2954EB8D9883DAD8BD5805FF247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/sw.pak
- Size 640KB
- SHA256 726ba26363103920712874418cbfc23ce899c46ca8a6dc3ec9da0bf48355622b
- MD5 289bec23992e6a40cdf54997ec0a4ca2
- SHA1 dfdf31bc91d739a630ea7ea3cf11d30067e2509b
- SHA512 77b35d56f847267df760359a5a3a803029658e109d7c579b639c7414171f78d1030797da693a63f639d72f5e914fbb87be0990272d46cce285f99ad55749c275
- SSDEEP 12288:3pyq/5q27zyxGB2qHOCdYGIGw5dmedqNGjRdponi91GKL3hjinSLeRtFa/hwzliw:ZvxxVFPiZ3a
- TLSH
  T1E5D4D5629C71D0191233618603DDEF732BDCED5C692B2DA35A46BF0F218F48C56ABE49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/ta.pak
- Size 1.6MB
- SHA256 fd8fe5c21a10e6542599e9148c8a30557c4d437b9606d6b29b685d474d89534d
- MD5 1098c8ffa99cb7a8b40887167bca0cb2
- SHA1 adb1d4afb72136dca61ff12a0b467b73ca76cf42
- SHA512 6cef56e1fea90cd0dd5c2dcc5e30fbd6a656dfb29327c63f48f1555c423e7f0d74ff68997d29cf9b86473058a5c4d93455073b53d7ad60923f01a351efdaebd7
- SSDEEP 3072:3cc1JjhiTktBIvRGPET5qstR9ztm1vYpiMy3M:3DJjhMktavRGPEtqstR9ztm1vYpiMy8
- TLSH
  T15D750CCE923EEE890F93288F0319536912986155C07BE3A67C766E1198ECC5DDF3427E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/te.pak
- Size 1.5MB
- SHA256 28b85fa550df913e970fac8a599ec4963b1466e3b610350924518de107e41602
- MD5 9639064c77e0ed97d5baf8e461078ccc
- SHA1 2deb7d6b7cec1a259cffc4a598e9cefd0289639a
- SHA512 574e0179c7d0d395bf1ff42b494a0f18ce8c96a52d29b8bc9f016243c6f15fef120abd314c123ff69eab4db824047c4d65ac21d5b65cec2860a9a9090a5c92e5
- SSDEEP 12288:Ui8g87MZKNuywG6sSF602/NNgIC8ymoRRT5dbJy52CM1WOB63N3p1Fn1ghgaC/lS:CgMp1c3X
- TLSH
  T1007593023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32