13acb6c9851318d39556a6b25a0917362656d9eae41f75cc907dccc0ec597619

Sharing

Copy URL Twitter E-mail

General

Target
Motrix-Setup-2.1.1.exe
Size 127.4MB
Sample261029-zhkhnaszcs
SHA256 13acb6c9851318d39556a6b25a0917362656d9eae41f75cc907dccc0ec597619
MD5 9e2fa597eae60b188ff0178d1932a4b3
SHA1 546f3648f387d624d7b82a16e79d5cb23ce6d86d
SHA512 a1b187aaac7fbcd3c98757a3792a8967df01c35aa36483c6586bd1a18078202f2f968c64c40f177ed24186c14a2cb04fc6efe63fc74acefc8c058100a9aad5f2
SSDEEP 3145728:WYLTdL2W0nYGWPJDXrA3wdr7ydC7wFKQhX5fiyNzMY6:TddGWxAg7ydCMg6B6
TLSH
T15D5833E5ABE9C279CA6535F10CBB4330D7852BEA44F80407239111677BAE0D77AECD98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Motrix-Setup-2.1.1.exe
- Size 127.4MB
- SHA256 13acb6c9851318d39556a6b25a0917362656d9eae41f75cc907dccc0ec597619
- MD5 9e2fa597eae60b188ff0178d1932a4b3
- SHA1 546f3648f387d624d7b82a16e79d5cb23ce6d86d
- SHA512 a1b187aaac7fbcd3c98757a3792a8967df01c35aa36483c6586bd1a18078202f2f968c64c40f177ed24186c14a2cb04fc6efe63fc74acefc8c058100a9aad5f2
- SSDEEP 3145728:WYLTdL2W0nYGWPJDXrA3wdr7ydC7wFKQhX5fiyNzMY6:TddGWxAg7ydCMg6B6
- TLSH
  T15D5833E5ABE9C279CA6535F10CBB4330D7852BEA44F80407239111677BAE0D77AECD98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/dist/renderer/assets/add-task-window-BEnE3OCX.js
- Size 1KB
- SHA256 c5fb647a7060e5f6ab7e82c2e884d39a482fdcb6d6442db42d8c67af013a5395
- MD5 6edffd42e0f3f62a136204a1e11efdf6
- SHA1 48d84ddac141a0a07d45b7328820c1a5fede9c5e
- SHA512 6fcaf2d7b65a49f7760e59ec7b56cb91a8f37c8829c99115db7e83701a78aaa9fc67412b5ff34625175e268646d59efaed617f45990e09ab653103deb6941b2e
- TLSH
  T13931B5BC913075B5F63A02DBE1A3D504723C7845164A42A0D2D68C2D5B780C726DBF6A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/dist/renderer/assets/app-root-CGB6XJW5.js
- Size 1.9MB
- SHA256 58dc9b171270e6b40505c298d99b040746b2f488ef4bfa7e22e4f3dcbc6111e5
- MD5 264315737bd515215516cbf8fa8178ef
- SHA1 28a2fe1bde430bc0c14df5093f113026d0196308
- SHA512 ab8b98e2d55c24e0e4055c8016329b0acbc822b5073ef9d66d6f1ae2ef18f30a5e4baf0b7353bc79f664279320271368a09541fdc301d48f1fe786c1dad99a96
- SSDEEP 24576:Yy0FAMiMvbR3i1ztrw2662j/nK+5Ef7XqjRxcc:zMiMvbRS1ztrwjBjPK+5Ef+jHx
- TLSH
  T126955C857199F4B49FAF41A600BF400DB33E6585DC0E4424F274ECAD39689C4A6B7FEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/dist/renderer/assets/app-settings-Df9bd-AE.js
- Size 13KB
- SHA256 4f86398bb434f8a2db512a6218351c28b5d407896e607c8c459fc84c21d0f54a
- MD5 01783510de937e3f28ad2c2208efde1f
- SHA1 2db652ae68c2780b42c57869d8bde0e5554ba7f9
- SHA512 8f954850e1a705e326f3a8840eb9a15ff26af865ecdf6e4aac870a073a2f0150fb53a97525546007fc56efdc735bbf5c7c77aab8e66a4f6d97762ebfa1919ceb
- SSDEEP 192:E7JKiaipKn8J+u336XMdejuPSktRX1TCU+QHtnKfVcz9/9a+:GKTip30uaX0PSktRX1TCU+QNnKfVC1z
- TLSH
  T1E752D8E97196B12009A26074802F945AF33F7493986DC464A2F2D9913DB0A4EDF37B9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/dist/renderer/assets/ar-DvrvF5TR.js
- Size 175KB
- SHA256 b004e2c3b7517978b286a2342ab3827e8f5a761296748f3ef79a4777e401ad8b
- MD5 784901fdf60d25aeee7e697f37014238
- SHA1 141a7943587a4d5164fdf408abac9c549ef37cbf
- SHA512 18e1d85ced0e84875e1d9759fb2566591fa5b061e8f0a23fa9a9c6925a6fa87101cb6164e0760d276d09a8a8cd80f7cf7b5aafcad47de0044ca90ad54d9a96e2
- SSDEEP 3072:RgGK1l0elJrmfI8Pi+G2sDYGOqSqvibRpjMLLhsPCQ9B09qGhw62cgUgKCsR5FFm:RvSvcS9I62NBOoiYUzqXoO
- TLSH
  T1BB0432E21A2584321B46CE4FE1D7355CE5B2AE23D78FFC3168974A2183D7923E24E635
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/dist/renderer/assets/bg-vt0TKTiJ.js
- Size 205KB
- SHA256 cfdcac5cafa22c2aec5f810ad438f27672e1b0f3f2880dc5168b58d2df773e06
- MD5 a65e3c3b31087b0f11dde8765715c891
- SHA1 4b5fd1cc37654e8dbbf77a6514a0188ce08e9736
- SHA512 050471a3632ac7a48bb81a1d8d3f366ca807017e4b100f83c878aafa8586d07fe3dab0b0e7b5f8e7d759cd3ab66d558f68bdb48db818b89a5be31a9ceb056035
- SSDEEP 6144:K5MDY9nedTtmJNz7DQQ4An2WsMWYQZa6GtRemMY8oO:wMc9nedTtmJNz7D2MWYQZa6GtRemMYe
- TLSH
  T1E924CEA1175968EF0501E59FC8047E0A3EEA41FE3FE7C29245B46CAD35F217483BA64E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/dist/renderer/assets/id-hAGTgg6G.js
- Size 134KB
- SHA256 44d38004eddb11d6de01a35a0ec06a082c79e0d65b36fd990d266c8fdf70ddac
- MD5 7ed27bb8fa2d36e22b6aafb50067377b
- SHA1 1f3f3db51e723836dff73c36397581e6bb838642
- SHA512 1cba0a880ef6933888025c55abf4006bb42398d1e239fe9d89451a69ca8b967b461c196eb921b41de386e75ac5f4afc9cd989f0ba52e5ceef2240fade527ebed
- SSDEEP 3072:6QJ9qVhdH8J6ElUcqoLqbGF353Cf1SNyEVVb:6oaHClUZoLj3CdSNyi
- TLSH
  T19CD3F8470E48717B0F2943D691C95E2B3AED13366380966FCDE4CF7401AA6A4F3279B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/dist/renderer/assets/index-mInq-V8v.js
- Size 374KB
- SHA256 bf2a7ed9043e60d2acb54db55472c71d3b80fcbd2328fb0c4e786f9ec2750b62
- MD5 9495be5eefba06eca998edb2c47e576d
- SHA1 e58a5b7e7bd5cf16c0e41aafe8b61025b6f37f69
- SHA512 008a6174ed7ef1f66dfa121e973beeeaa53fc8fa0d5ea87d5dd665b21f077e06515edb960e2d7848ac8621f5dd7e14b1db955b60b69849eafe9f47556907dc52
- SSDEEP 6144:5iS9bH146LAtSlzKdwLDh/ohYvtFA/UIVyI8Fhwh3JItOXQObx:5igAtS8dHYF688ZjXZx
- TLSH
  T14F847C9B3259BC370B9643E7619E0642B3B9026991189414DEFCC65C2198FACF2F3F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/dist/renderer/assets/it-m_AKUY3_.js
- Size 145KB
- SHA256 bf0e27cfa6a35537e117d0ae1738e8b02276061fb643778809058557c00cf4f8
- MD5 a130fb481a14c89f5f96be28aae39796
- SHA1 744dad309feb0f149bf4afee265e696d19826c86
- SHA512 a56e29852cc68f782f5b05342ee089c953fdd38dbbb4e9c3cbd4e9a6e6155ae6fa07094a0c78bc4a15d4754cc919aba02b088ba30201d0e4a4c18d289b4d5498
- SSDEEP 3072:DJW+HvtGwdcQmOeLkCC1QLOHYBDRLuTp9z/9bwgFSCENTkNwqwVw:lhHVGwdcQokCoQLOHYBDRLuTp9z/1wgd
- TLSH
  T140E34B3B158918332F6B13CDD15A728273BB909DB5855068CAFE431C229DF84F26F5AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/dist/renderer/assets/ja-Be4oyoLJ.js
- Size 164KB
- SHA256 c1f3fa5c77ee391073d928cdadb205c60ab331d6db36f0fd6d88efaf90fd3dba
- MD5 d05754ebd06c37c344d2a9d21a1e4589
- SHA1 da3e40a8fae4c0b2c9e27bc8d861c811ecc2f51f
- SHA512 81e77f4e460bad91d501892d98583917d11d204714a6161126bf5aaab08df6333d8e4e6a6abc137cf07186a6be5a9eebcd86ddeb24ba94e843f01ce34549810f
- SSDEEP 3072:tjDJ9ilEBZxXQyxfkMsOWN70dhsKBKeYhyvVdiSRFo+fFlaVv:HgmZxa3QdhsKBmh5S8+fF0
- TLSH
  T165F3C73DA3C999378D2543F3184D26C2B2755C1BFE52767684BEC038AA74B8EE110EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/dist/renderer/assets/ko-zgZv8kwZ.js
- Size 149KB
- SHA256 7200aa17e52ec581d04bbcb0f5b128e3bb803ddd51a0cbdf131f1addcf9c25d5
- MD5 14852e3194c52d3d8dfc5c60878dbf77
- SHA1 c61dba5c6d9e403c0c847ccfa5469ee2801b85e9
- SHA512 e37e9029bb3c8c15fa72ace8f0eaf95daaabc4074be45210e0ff14b3f7488eb57b4f9c1fa9afba751b7d1acbce8df635d5076766955a8de3a56f0382d589ef0f
- SSDEEP 3072:wJNAup+AJKZpmwXsQixr5wAwivPdWn+bAQJ1JuOV8l/W1VF:I5tJ2wJQiLwAw8PUna1tOl/Wp
- TLSH
  T184E3F9D33CAF96B655D786C61ED8BA1583D1D263F3434098CC99CE049968ACE460BCFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/dist/renderer/assets/nb-vSlhWe0g.js
- Size 136KB
- SHA256 260f7240b8cbbf4507d9ef1c9aa41d4e4069eeb18e17ff51a72c9ae3f1438f04
- MD5 ecc9751d8018384fb99ab8222ae5147c
- SHA1 776b6ac3e84a12911ac61450f7e0c0195572f96c
- SHA512 832ab96c276c40d249e3c1b14ed59c463f72329a46b5b5e2ffed013c02bf703859a477438031326584b0204d347fa05ffb2e21c31c0c7914be7d287c2f72a5c2
- SSDEEP 3072:zj866Jf4DeVgXHuDuhZxWtrhXxUK7kRHvBHeyWDZSQcd/c+VxoO:zjlGSeVg+ihZxbvB/WDgzBoO
- TLSH
  T151D32B538A216F3F1F5583DEA49C0E6A47BE812ED298444BC8ECC46E145BBE4F27F452
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32