1fcee9cd4a4c1080d6acee16d6b7b1a9593971283da2a02f56406218d557ecb4

Sharing

Copy URL Twitter E-mail

General

Target
CryptoKit.UnionPay.exe
Size 4.2MB
Sample261029-wx7pysca64
SHA256 1fcee9cd4a4c1080d6acee16d6b7b1a9593971283da2a02f56406218d557ecb4
MD5 9f11ad646047260e2fbdc8f756f0cf59
SHA1 70884d4f4da741a6a0030d00247182de7a177946
SHA512 364bd07c64f66d0f7f0a11d6d4a34449738385ed3a93ce8c3aada01bf93db8f84051b269647a9b18bfa3f55f7fed38dbd2d1e304451ef5f25eecf00d38421c16
SSDEEP 98304:eAix9A3Dv05fTksg0AaitYpDbdyC0EVfvhZiuDHw:eAR0lFdz0Cdn0E5Z8uDHw
TLSH
T14E1633D373C582AACCC90BB38A57FF6393B3AF906AC81201B697321D1C73985559774A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CryptoKit.UnionPay.exe
- Size 4.2MB
- SHA256 1fcee9cd4a4c1080d6acee16d6b7b1a9593971283da2a02f56406218d557ecb4
- MD5 9f11ad646047260e2fbdc8f756f0cf59
- SHA1 70884d4f4da741a6a0030d00247182de7a177946
- SHA512 364bd07c64f66d0f7f0a11d6d4a34449738385ed3a93ce8c3aada01bf93db8f84051b269647a9b18bfa3f55f7fed38dbd2d1e304451ef5f25eecf00d38421c16
- SSDEEP 98304:eAix9A3Dv05fTksg0AaitYpDbdyC0EVfvhZiuDHw:eAR0lFdz0Cdn0E5Z8uDHw
- TLSH
  T14E1633D373C582AACCC90BB38A57FF6393B3AF906AC81201B697321D1C73985559774A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CrxInstaller.dll
- Size 758KB
- SHA256 8e92441227f30d715dd9e39569e057f0bde5344e14f978e12f93cb6c6bea8eea
- MD5 12b3f1078692738533a3042abbc76144
- SHA1 8b504f9336e4ea434d6d3f3ef9f3a57323fe73c9
- SHA512 25c102e9ead20b929e5ab585a7021b840cf57835258cda7871a685af93e6a8b5a8296ee14203811a94b0282dfc5fc7b40f57f1d9b18f340a4c30a4d6d4ca377d
- SSDEEP 12288:VjGgsyxGOF1ShY5//kGqFL2UXiH8IEFQsavTsWqIsr59:VqgsyxGs//kGqFLzychFQtTOn59
- TLSH
  T146F4AE17F6C5C8B2F49E0179617366BF8A36EB2143EAC5C387A079558D313E0663D38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 4KB
- SHA256 337781f4d7524150600ad958aaf3d78b5bcbd30e921759bc7d12e7488687348c
- MD5 c764de9b88eeec6a17da10d523eebe5b
- SHA1 7d15fcbc34f5d0a970e303dd1c39ad981377fdcb
- SHA512 647339f01443614dd60e048942abc0ec2dbc13200162d072dce4dd07d55661c2f1a9051a6096c614f934a3c4d33342266d70fa6a7ed9f4bb042f804fe5fb170c
- TLSH
  T1C48185BA56E54FF9E1581D3030CE7013EBDD74B116AB625AC93F151A7BD0190D43C632
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH
  T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $SYSDIR/CryptoKit.CertEnrollment.UnionPay.x64.dll
- Size 474KB
- SHA256 87b7124d061fbf699316fd23f7992a1043c7f3a4a403f755c1201b10bc5fd423
- MD5 8a45f5ca118b7b095bfd24b08820947c
- SHA1 ed09e13d4e334fdf0f69059d9ad2d7f358c4fb60
- SHA512 24d5b5cf2cd0ed6a31dbae6af21ca9d27f14dbcb60c16dbf44b543bd6e6ed76ccc5cc0b7dc3bffd786e4416d76101c27c832dba2b5a453aad408a611ea9450ee
- SSDEEP 12288:PXxQAe8HsCXtbnCEcU+JXtTzBetU7DxlGaSwADpol+1uRz2zLFcaL9iscNWty7FF:GAe8HsCXtbnCEcU+JXtTzBetU7DxlGaT
- TLSH
  T1A0A46C19E79000A5E0B2E579CBF69276FF31745D8B7586DF2B680A1E2F32BD08835319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  $SYSDIR/CryptoKit.CertEnrollment.UnionPay.x86.dll
- Size 413KB
- SHA256 0940e9492cb5d7e98e71bb0825afcc6d6ea8d1117a6eccc7304b606558a52911
- MD5 50d58ca4e3b4763840927bed33d59d32
- SHA1 86388f02e92b3e55fcb480fbdbf97c8786bf6487
- SHA512 deb9322a900c2041534c9cc6086c7599332b62cc85d4fe49b0fc543cd3428bbbd8957364feefb5031299428e695dc2d5ef8e8c40b27e56e40bb6cef961489b04
- SSDEEP 6144:mwRXz5ntPoKqvu9D0w2waw99+Mz1hEGH0+UlKSNLeap:mwRXz5nOzu9gw2waw99+MzkbL
- TLSH
  T127944A71A6D5C031E4E6207056BC46B72C7ABA325BA1C8CB7385185D8AF67D2DB3432F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $SYSDIR/CryptoKit.UnionPay.x64.dll
- Size 436KB
- SHA256 5878fad5492408132a674921bd3eb587014465641ab553c38859e59f2210ce08
- MD5 7a2320cc011345097b5c090a2f3447d2
- SHA1 f3f7df6f59190aabc49f0e8630d01c0e880940c1
- SHA512 72b92aa0f68445d5e6843888d4d900bf09da32fed95e830b31d73c0cd525d751909fc573219d70d9faece43a519d6e4879cf9440c25672f653d05e88a39ce6e0
- SSDEEP 12288:7quDf5qPUL6u0bHi/rt7PgXvvlwQfQWr8KpG/w1OYRpEMkY3NtEwCsxgtsSjggXE:7q85cUL6u0bHi/rt7IXvvlwQfQWr8Kpj
- TLSH
  T165946B1AE79408A9E063C179CBE79226FBB274599B7086DF27644B1E3F33BD08835315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral15 behavioral16
- Target
  $SYSDIR/CryptoKit.UnionPay.x86.dll
- Size 379KB
- SHA256 f77b1fe75e2403a369cd926e3ddf77bf20f7bb0ec4f72889cea0d10897f18f85
- MD5 739560fd60762bc22e3d52765f784a78
- SHA1 02c7c1ab1db36098bf1b698e263b12640f6d2c02
- SHA512 dadb3ccdfa7d80ddb29a26c632af6d2f9a9be66882a7af2debbf9c37ae7aebefa51e55e16542159d3b56d158e8ccc44e82cedbc4a8a313acb4a472b96662ef57
- SSDEEP 6144:zuJDmAtdvP0SIJmoOoBYNlobYwrLnMzPFH0+Ul5NLeaI8iv+t4:qRrdvcSIaoBylyYwrbMWyWt4
- TLSH
  T101847C20ABE5C031E6D61AB0567942B6187EF6312FA1C8CB73841D1D5EB27D36A3631F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $SYSDIR/npCryptoKit.CertEnrollment.UnionPay.x86.dll
- Size 473KB
- SHA256 836b9791054fb86ca87edab6ca7d7e66fe100a04149a41b286a5a54cb5b0560b
- MD5 5c730a218b85042302a1c2a14444b21d
- SHA1 f1ad4b301381778c9160b627c2f82aaa81972fce
- SHA512 b4f7a631aeb8ae134a30b277ed9a85af9956207728668c32b86aa02253d17962d09c1fc9ede067135205cae4a10dfdf229c797cd54d564029f4b6989fe36f078
- SSDEEP 6144:DqYYSUJY4t5/VjKWEBjU1+SCEGIY9WPg7REZH0+UlKSNLeaK8iv+teI1:bYSUJYi5/5KWEJU1d1Gr9WPgSWIWtp1
- TLSH
  T1C5A46B51E7F88031E4EB287475BBD7A31C3E757623B284CF9348951A5B626E05A3C32E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $SYSDIR/npCryptoKit.UnionPay.x86.dll
- Size 411KB
- SHA256 2d9c7e19782236c86906f3923058398ba151db8f12642b21ac4287ac9dd54a00
- MD5 f422bcf71ae73cb745dac7e4256d048d
- SHA1 b9d08af0d86f11d7b9b699da64d2345cae38a64b
- SHA512 1534d7676cdf291f07306f2490fc6ae5b8780dcb6faaa085ebb755bcb6130e59c53ef3a5cad08e2d3bfc7c8875050b04e134c2ffa427b3cbcb0c8ee66aff2b39
- SSDEEP 6144:BRlXCa5E0D/FIVEtwm1pesn2eh/ZdELAb0DH0+Ul5NLeaI8iv+t8UH:BXbLHwm1pe/eh/XE8jyWtN
- TLSH
  T1F5946B12F6FC9433D6966EB067F591666C3EB57247E2C4CF2340081AC9626E34A3536F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  CertEnrollmentHost.UnionPay.x86.exe
- Size 471KB
- SHA256 efef0c8b21b12401cecdd82e079098970ffe669b4a7796ce13e60cd617795c97
- MD5 b07fe4b6bd5a31a9c53d2bed4646cd9a
- SHA1 1b8c80ef5aeab9e3731a1feab17b52f8e6c43617
- SHA512 47602a0d8e93cd6d397a76251d712eea9688cdc36c3ac1c5aa5b32250fe4cca3ece3d54d9230dad48eb0c6927a60b0d29f03e2da8772feab72e38af23dc733c0
- SSDEEP 6144:MjbiMQzjSzB79zjHLj/ihLX9oRxD50E8eAOPZK04H0+UlKSNLeaV5hN+:w9BB7lj3ihL9oRZ50E8ex7pDXN+
- TLSH
  T124A47D22E6F8C435D9A31570D7B98AF12C3EB1761722D4CB37E418998970AF4A931B1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  CryptoKitHost.UnionPay.x86.exe
- Size 368KB
- SHA256 40c4af740c43fd7c3adf87e43866391c5c9a5aebc6b25b953c4e1e907443f5fa
- MD5 ab1b49fa76597a54ada540dc9784a4db
- SHA1 fdaf14d871d547a546e4a5d0e550a66044539d12
- SHA512 2d76aef9628c76b2086039d13aa6fd651151525fef29402d79215c63a6fb63164d2d2e9dc58b91abb997c822a83f4ca819f7fa30cb1738276704691435c804f4
- SSDEEP 6144:4ElOkVZIBBoamLlnWakxXQAORh28iv+tvH:4ERV6BoamxnWaqXQwWtv
- TLSH
  T1AA846C23F3B4C073E6A221B1A9B997A9287EB2361F21D4CB63B40D5C5D606F0993571E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  cpkekonaflngeeomdaofgeiolmljjefe/3.2.0.8_0/eventPage.js
- Size 3KB
- SHA256 b24e2351df4b5f64f7ccd634e40672f28c551536c9966251bc61f324f1108769
- MD5 7991798907737bdb6699d5f5f4b90f51
- SHA1 5a65793e4d057186fa9827b0bbc8049e1608b1dc
- SHA512 19ce553bae794bf2afd08ebb4695c7c2e2863acddb27757f33fe91ccf2d9a1121ce85a2a51e7ddc3a203255277522f52e902c51b3247a7577f86d136befbc1e9
- TLSH
  T1FE7191961ED321564773A3769F3B1601FA3A61570A0D976CBE8C47E11F348604289FED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  flaibjgdieeiakhdmgpkcogifikjnjhk/3.2.0.6_0/eventPage.js
- Size 3KB
- SHA256 b24e2351df4b5f64f7ccd634e40672f28c551536c9966251bc61f324f1108769
- MD5 7991798907737bdb6699d5f5f4b90f51
- SHA1 5a65793e4d057186fa9827b0bbc8049e1608b1dc
- SHA512 19ce553bae794bf2afd08ebb4695c7c2e2863acddb27757f33fe91ccf2d9a1121ce85a2a51e7ddc3a203255277522f52e902c51b3247a7577f86d136befbc1e9
- TLSH
  T1FE7191961ED321564773A3769F3B1601FA3A61570A0D976CBE8C47E11F348604289FED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  igiadmhndphenajafopeimbkfnnaofia/3.2.0.8_0/eventPage.js
- Size 3KB
- SHA256 b24e2351df4b5f64f7ccd634e40672f28c551536c9966251bc61f324f1108769
- MD5 7991798907737bdb6699d5f5f4b90f51
- SHA1 5a65793e4d057186fa9827b0bbc8049e1608b1dc
- SHA512 19ce553bae794bf2afd08ebb4695c7c2e2863acddb27757f33fe91ccf2d9a1121ce85a2a51e7ddc3a203255277522f52e902c51b3247a7577f86d136befbc1e9
- TLSH
  T1FE7191961ED321564773A3769F3B1601FA3A61570A0D976CBE8C47E11F348604289FED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32