58008ad7a22ada0b4073afa415801746e027c5f583e4fa52d0f4e9193b98d6aa

Sharing

Copy URL Twitter E-mail

General

Target
mosquitto-2.1.2-install-windows-x64.exe
Size 25.8MB
Sample261030-dew7dsas2k
SHA256 58008ad7a22ada0b4073afa415801746e027c5f583e4fa52d0f4e9193b98d6aa
MD5 661fcfa68ce6f4977a8319d7a030f57e
SHA1 1057081bce8ce408f6138422c750d7a98e382ca3
SHA512 1c98130c2d52e3178767c0a7c286ed40c19962962c85a6c6dafb522a11d453d9696de45b969787fd60a4adb903f9635fcf01af263ca465c198d11d3cb23bf24b
SSDEEP 393216:e5Bsfm6cjhQ7e+DnwgNFYc4yOkLMFEVt2QNUgbsSOWI+usColS3liMooQy:egeLjhQa+7wgNaclXtEQNUgISOkujbFr
TLSH
T1F15733387052CA2BF459A1BB42074A3292EF12E55BD3DA25951F80E0E8663FB5F1FC74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mosquitto-2.1.2-install-windows-x64.exe
- Size 25.8MB
- SHA256 58008ad7a22ada0b4073afa415801746e027c5f583e4fa52d0f4e9193b98d6aa
- MD5 661fcfa68ce6f4977a8319d7a030f57e
- SHA1 1057081bce8ce408f6138422c750d7a98e382ca3
- SHA512 1c98130c2d52e3178767c0a7c286ed40c19962962c85a6c6dafb522a11d453d9696de45b969787fd60a4adb903f9635fcf01af263ca465c198d11d3cb23bf24b
- SSDEEP 393216:e5Bsfm6cjhQ7e+DnwgNFYc4yOkLMFEVt2QNUgbsSOWI+usColS3liMooQy:egeLjhQa+7wgNaclXtEQNUgISOkujbFr
- TLSH
  T1F15733387052CA2BF459A1BB42074A3292EF12E55BD3DA25951F80E0E8663FB5F1FC74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  cjson.dll
- Size 34KB
- SHA256 03e5fc7812741175b9220dc6a85ad787401293fb4af69c264918a6f84d6f6f04
- MD5 2f58f71b0fbc5543151c5caf28f89f6a
- SHA1 9d3ed1f53eb10feb06e5bad94103cd7baa688d0d
- SHA512 a8d068c6c66375c079863aa41b069a284925a952732f4afb5d6cd4da9a419e40317b91e22d4b249637f8356019085a20d775fa617b02e269d605282d2a7f8a4d
- SSDEEP 384:DdVLuqKiGW4cfEhD7E6kjFnm4EsbsG3vCmy4w8mZpv0qJAgghA/uqkuL7ehN3UBd:ZMfGms/0T3vvJ4v9UBtV
- TLSH
  T177F2290FBA9404E9E29AC27A8A66584FC37331F163016BCF1F609AC66B43DE5143EF15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  dashboard/app/consts.js
- Size 577B
- SHA256 7462a77af56c626515dfae910cbb02abdb281c58f782c5f5e8629248afcf7245
- MD5 dfb7735f24fbeb8e8b49eac64d680a8d
- SHA1 a66d196afa3a79cc823ee049ce0e68eb041d235c
- SHA512 870fc30c48616f23082b4f5d7d99dd2f486fa352cf8f35c0602b2fbe4de7f5dac01b0ad16e4d781df9d0b44236e5548592be04090c9719ecd55d520d47407ab5
- TLSH
  T13DF0C262444D07D56C686FDB20090275005F1305790ED1D8389A4AC298FE2AD3F5A9E2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  dashboard/app/dashboard.js
- Size 54KB
- SHA256 a63a1c2d9846b391aca80648626e9cbe295e0365299f464a042e9633f9ed65ea
- MD5 a758b622f0d451c2e714cccb5bafea1d
- SHA1 7f719e3f8c778919d07d961d4da4dbd19dbeeabd
- SHA512 b26eeb9e3565372f2c4bcc52b910683b309a2cec640da3b28b615ca28ff6218f726d83428bf472f2182a899454a476456e73c99d0e65e4fc47af64c7ba15e1a5
- SSDEEP 384:RSwg6GL/z/0sjVyeIErPQxuQN/XD3K0mQOKz46PZOb2:RPHGLHQFXD3wIxR
- TLSH
  T123433F09E4B859E6D4B353AA9E6BA100FA51131F7581305F3FBCD3D40F3942069AEFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  dashboard/app/index.js
- Size 2KB
- SHA256 68a75fc6dcbfb6af1b1c83bc6899e9e50b720a6921b6190f3df4c52ce5fb8140
- MD5 3b4f1f48492c6a2ed2c010f67f7c1f87
- SHA1 161afaa2c62f61979f2b99e00b49f22fda05468a
- SHA512 9f4f60958c4a1a336db2fd176d7dec22b39088a358f93a68a99cafbf24cc3b822ed7153d5a51615dcb7079dced7d4c29d3256566500ff63625463e95794bf206
- TLSH
  T1DA510FA66E750A39CD3A727EB61A6224EE706033BA41D315B84FC0046FBD95191B3FDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  dashboard/app/listeners.js
- Size 9KB
- SHA256 7eb8900e53a0071c006424973e1a2dc809f27972aa5f98895ea0b5239c5533f7
- MD5 4280c5d01943dffcfcbca355a8bc719d
- SHA1 3a490eb4ce869fc4a7d94680189e1979023d6e7a
- SHA512 fd9d249af3a12dd67e22b7e22432ba2fa456323bb1be42d0f8903fbbaadff70f3ea5931b4c3de3173e4ce0e792bbd79bb2f799ab0dd88403499b268de565d5d5
- SSDEEP 192:96/ruwUvFkFYIiugiM6TQWOyvia6JiHiYiiiYqONPcVHpCrEuQiticHvlN1HOfT:KYFgi1iM6TQR2i9JiHiYiii1iti+ub
- TLSH
  T1A7121F65867E053585B5A35B7F376388F7A4722B52009A0E3ABDCDDC1FB1C00A4F39A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  dashboard/app/sidebar.js
- Size 2KB
- SHA256 d61f2262ef04748bae7bf74f16e46b3c421bec6be084e0a79e63c59e9277a9b5
- MD5 b2558bb9da4f936fc951a8bf22fb265c
- SHA1 038939938f87b3755d76c6481131def753ce9601
- SHA512 1e8304af7c6deaf8cc9cad2d7d8f4911070b066b7ac1ea7fa0f48a767cde25b9b20b7f4db81fb47b840528a83646f3c1612378b41092354cf5226e70f7964b7a
- TLSH
  T1FB4165A7638E063AC5FAAB7A6F41D138F735485B0902820E7CACD5C40F759B044B5EF9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  dashboard/index.html
- Size 80KB
- SHA256 c5d14e3b618e8c616bc8f3ad96e984c5b3904f3d63586156b1e7dbeb7529b492
- MD5 e9b9233aae0644a4ec90fce4888ab295
- SHA1 5c704f2affc9473a6ddf1b66195c295a224e7ab9
- SHA512 5c9ca451fb2913ba012ac67af52c575266c6c177c4edb4bad9f4c6497c0202bbca577dd3b7c05d37cb583be290670984eb2fba29db4746f09eb214ace16f6baa
- SSDEEP 384:TR33naUwyZW9W5R9WXJLJ7QjXsE1RsewUYG:V33naUX4XJLJ7QjcE1RrPYG
- TLSH
  T1DD836124A6C40D7E60778282EBB1772AFF92D2439A0F6158B1EC16B72FB3C58DC17594
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  dashboard/lib/chart.umd.js
- Size 199KB
- SHA256 e0182ace90070f869006898608e1f3bed3579f7493e232b9ff5d31e3b61aaf2c
- MD5 864b197d931bc2fcfacc178161e53dca
- SHA1 658d890a4c6b4ff6c302cabea947d940d21a6593
- SHA512 ea4963e956eb0a775eb5fdf64fc27200fc82ae58ecfe0168055f7dea46d36909d8c566268c6fb6f83375a3c40c66146167485e09009549200240bd5b9ecce10f
- SSDEEP 6144:Wyxz1v7LnC5tHzhSGmef82TLK8NOleMR5LTwmNV0fjQknu9t0FE:h3LnC5NzhSGmef82TLpIeMR5LTwm/0LI
- TLSH
  T1B614F5D53342B12282E256D2583A050AE33666483547899CF6BC5DDF3C6A98B71FFF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  dashboard/lib/chartjs-plugin-zoom.min.js
- Size 14KB
- SHA256 b6fd8b099d756f76510116289cdb79ee3e4aa4745b9fcd4c8ace134cb5565440
- MD5 e770911f526522ba96576b1115847d5d
- SHA1 425ea6aa22fa9032abad05e28d5f94fd510f76c0
- SHA512 2fc2cf27d8534e8fb11a51cd804530c88589207926a0b5c24af6e45e40177ade52ace754e960f1fc5e30cb0b81f14ebe6f731bf2b98154715c1f3055b23475d2
- SSDEEP 384:K2WrNRmY9zJNAMlbhzJJ9xdEsmfgb5NB23/2PBlnMhgzIBjQECa:vinmY9zjAAbhzJJ9xdhmfgb5No3/25lI
- TLSH
  T1AB62D84CB452F7A82BA22EE1532B4119B23A3A11740FDCD1A45C99F23D7509F52EBD3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  dashboard/lib/hammer.min.js
- Size 20KB
- SHA256 93a1f648caa53a982d1173c1865c0aa5d12a7cc68c72781dcf404be929af061a
- MD5 b52733a0a5dd4710753854f357056ca3
- SHA1 3cd13fccfeedfe4d618c01e86ff60b42dbfb6858
- SHA512 98d1bdc88ce01c2d579189554af6a34aacd2befa61ac5f6079a1688ad07e582de3910cc3b6a7c710118e71937c37421fc35d5f1cf75558046f509e11016fc411
- SSDEEP 384:Fb5vj+l3jfaksTAAvNWUwLATFqNCns+CSHDJDLrIo:d5vj+5jfSTtrTFqNCs+CSHtDgo
- TLSH
  T1EE92C68633C7728192A720B5A0AF020B61378C8694CD596CB4BCDAD57EB553C927BF3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  dashboard/listeners.html
- Size 15KB
- SHA256 eb303f0ba219fe016cf07b9b5e049e891950d406ee2a5cd848be6da12cd3e025
- MD5 3831dbf899f3bc10a78f0c2c4675b50a
- SHA1 6dc3447f8c74541ff8212256a554be5578f10cf6
- SHA512 22332ab56705a6af13d683099b548757d1d27cbfbffdc65048e68593b42a15b5b9b20d0886955a959d4448ef2b9824c1222f92eda609c220d22aa0c2c58fd079
- SSDEEP 192:T0k3OIakwyZBkNC/gWV+IkNC/gWu3M7XYi:TR3OIakwyZW9WQR9WG2f
- TLSH
  T1EF7261B452D100786573C2A6AE606B6DFE96CA93DB07864CB2EC16CB1FB3C15CD572A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  dashboard/media/banner.svg
- Size 3KB
- SHA256 7327a053260f5132a17e892ab68caf656cc94015f9ae3de6b7f0673636cd91c6
- MD5 0b13524cacf590d23ebe628c9d7b4608
- SHA1 e5e3bf18ad4649c94e894dede750ce23618a8ab3
- SHA512 9ecdfad92947754e325d8762fe3e7864969ba8768f31a06fa484483c72700d2016065a5e27b543c9ab31b47cf2b1fd7aec600a9b33c0fc2b06ad5b7167cf0fb7
- TLSH
  T1C071FF7C874D92FC984B4BBC8F229170E30EA1A9B2E19324CA2ED57065939DCD19F858
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  dashboard/tailwind/tailwind.config.js
- Size 156B
- SHA256 eaf1385aeb0897f9f212927040bc8de1929e9fd089b996f017a1d03a8e2e14c2
- MD5 aa995a635bec2b40eeaaab90aac199ef
- SHA1 a4f5573c54d9612bc2470734bbf062ceb7a7d2de
- SHA512 c1547cf9b9657b91844d37155a3be5289833ed25ad85832012cea4f53b2654dc9e9bf660993e5da2d5ee8a831150b3a823d82b0c876ec10950393dc7e32dbf5f
- TLSH
  T11BC08C1304EC22674234C05062C14BA4ADC8833209004C2779BA256C179FA6A40E1F88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  dashboard/utils/assert.js
- Size 154B
- SHA256 f6522e0e2f93b692613040121c2cb5a9481f90b679e989e94f692dad18af8723
- MD5 3467c5d9d532d10f06511d0595c4d82b
- SHA1 33a31d65a8dd2137988c960cedbdf1d7d684ecb1
- SHA512 ef2086df7e03b70f896b1b239d0938a1ef51ee74077940adcdffeb4547d0d5926178eec01d4e8fcca3a61e7499a4e4cf947282265573a4e51fa53713cd6926a3
- TLSH
  T1A4C08C80AB590E234235373E613E4022DE618A61492006D0B3B488C19D819648F6ACFF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  dashboard/utils/queue.js
- Size 516B
- SHA256 509b7497f76a2dcd302409d5e9c9c8c90786303b1a699e3b236d30863c0c7b2f
- MD5 f41b2845f66a4a305a325a6719cea700
- SHA1 2a42b5daf60a9e58b51a45c5306c2635e3d3fd80
- SHA512 cc2e8aae46f29cd4a51f378365ed25df33388402f0610b11ff25534457cdc205858daa1a26a2fa4c1f360944a4646c75c1ae8fa1be6f5ec82e21c36bf19ec679
- TLSH
  T19FF0A75D0A9F26B8C0B137A54E479161FF3299E72E23428C71CC41704FB8990411EEB5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32