55ab7f7f075297898cd2b608789437455e5428c01b26ac69588ea82587c7256b

Sharing

Copy URL Twitter E-mail

General

Target
plexo-1.0.0-rc.15-setup.exe
Size 245.8MB
Sample261030-knw2baxy7p
SHA256 55ab7f7f075297898cd2b608789437455e5428c01b26ac69588ea82587c7256b
MD5 dad8e996bca599ef4650139dbbc1b8f6
SHA1 b77ee8676e472d82755001f2ceea219df0562523
SHA512 a549f3ff73e14975d0192bfa7098a989d5c3a4871c28fc71d1e83d970e2e46356fe7ab9c60b4d5f42a2786b360bcbe47d0e9bf5d65417eda91631d1af60eb619
SSDEEP 6291456:kQnZtGGc5IFnLzsSWSIwAYsppmxuMIHS/RgSIW:kCTGGc8nPsSm3eEM2SpkW
TLSH
T197C8339DB2C4904FD353A3F7029D4AFF666688A3E09346472FF86A14C725E9C5D38D22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  plexo-1.0.0-rc.15-setup.exe
- Size 245.8MB
- SHA256 55ab7f7f075297898cd2b608789437455e5428c01b26ac69588ea82587c7256b
- MD5 dad8e996bca599ef4650139dbbc1b8f6
- SHA1 b77ee8676e472d82755001f2ceea219df0562523
- SHA512 a549f3ff73e14975d0192bfa7098a989d5c3a4871c28fc71d1e83d970e2e46356fe7ab9c60b4d5f42a2786b360bcbe47d0e9bf5d65417eda91631d1af60eb619
- SSDEEP 6291456:kQnZtGGc5IFnLzsSWSIwAYsppmxuMIHS/RgSIW:kCTGGc8nPsSm3eEM2SpkW
- TLSH
  T197C8339DB2C4904FD353A3F7029D4AFF666688A3E09346472FF86A14C725E9C5D38D22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  plexo.exe
- Size 234.6MB
- SHA256 43fcab90988f161f6915ed833f4611778e7cab4c130b3adc46c5cf28daf24fe9
- MD5 42e1074605c2d0e8a05ae8076e6f75c9
- SHA1 a75664fb09affc88ada8467d7a68646bd57eaad2
- SHA512 272d0d3829084ade4e9377fee756c304b665aa71f1efeab8b26a9e1ca8e5489e687569b58238f5068964a7629ab2439e8bb5dca3ac46aa53c6e4470acd9efea2
- SSDEEP 1572864:VZeQL+8BlotYAtFTYUYRdBS4m286N/3R4A82vDavq0zzovrMzdlKNsXh1uSKoosH:x+89AgRHZkN
- TLSH
  T194C89D03F2AA41D9C05DC1B9975A9633FE71B8094725A3DF2B5407922F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral6
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.node
- Size 151KB
- SHA256 eddd60b400bd7335da06a9a7984c1a342d317ab79c7802e04438f3e02a16ecbf
- MD5 6bc15c82774761a63460f660de1da5d0
- SHA1 57c34eb12fb6b3529e21f907a17eefb4ab9584f4
- SHA512 7cf56f3a913356765f545ecd5b9868ba7026021cf013c9d0fd8219b6d59bc980c3e61c3b21450eee217759bc8e135a6a30614452e61e780f6762eea9d48dc718
- SSDEEP 3072:YoKr8kAp1Re5ACPmntJtE7msnSU3+8rwe13wV6gpoG6TCtDL7M:88p1oGeaiisSUJYpoG6TuL7
- TLSH
  T1CDE36D5BB3E501BBE1779238C9A35606E772781217609BEF039043B52F237D19E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/fallback.js
- Size 899B
- SHA256 f4a65d1a98db49439616119fba09be0d9a4217af57b21282ab7b91c8b5a082b9
- MD5 e7225196819df0032629fa873f3a6a47
- SHA1 2e089facf7a2df11e50f693565c810b9de0e4095
- SHA512 56b89a7aff78fe2a231f3622804461e41ad67ebb87ef2eba4dc75cf0b1cfec769318fbabf7f2bd2c701b7beae3856a38d226905d16be7353199d215dd5758191
- TLSH
  T166118C6F6F14126D0407F7D581859E8F42344724F3EBE988853E7D210DDDA614EB2CD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/index.js
- Size 136B
- SHA256 70846a43c2bd3b1077461563194e4d2407b18e7d767d6fd8785ea9b7d6ddd044
- MD5 4ce2ef7ae60266e7ee9f8a4078117193
- SHA1 a11314facf16ceba23abf556cfd3a13264a3e390
- SHA512 840f27524a2b576ba11631beb55940473b74f540dcc5fcad058b47e5c0a137fea946555041224fb6ef1c1fbf2704d01ffc6a046c7352dca45e7b55d2acc00df9
- TLSH
  T1CCC02BEB0CFDBA8312D5C143E160861360CEC090084C4401C75807C303C0C880B93DA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral9
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/linux-x64/bufferutil.node
- Size 14KB
- SHA256 9d0bce137193c8630da76797596742368798f72d1564d43be0d716ac74312bda
- MD5 7bed42b6c8c87445fcfa9eff7e053014
- SHA1 545b666326b5b29679acdbf31d799331c12d6c59
- SHA512 9f395cda93ff254edfe56614095ae73337dac604b605f60088ea81f5cd32b6c8c97df649992cf54c635ab33b4a342a9bb1a3c35cb2d478156f8200e86d5bc726
- SSDEEP 192:RbP8IWzwUBxpB5RJhjPee+CVVRjTIU+6tpvkQi7A:Jyz/BxpB5RJhTeebVyUttpvoA
- TLSH
  T1F462C81BF361CD3EC45C8234C95F8B3067B7BC98567103272B04A63B1C936656BAB99B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-ia32/bufferutil.node
- Size 126KB
- SHA256 d3cc72764c09f4b2a7f885f5167811fd22dd3728b59bb1a18fa5a6f504317689
- MD5 788a615b21988f3643ac21a8669c72a4
- SHA1 1e74df3e1215bbd035817e73e8f6b9dbd0f8a064
- SHA512 72987562ca9cbfe5dd513081f8d961bb66672d4bdf0e28a411ad870c6c0942b9602a9a22e6674b13b121f821ceaff371bb3fd6105ccab6eb5320ff5df3c311e8
- SSDEEP 3072:xcVDS9QbSK27JKr/AS9SaJWAGk52TpYndT+6FSGVJr:OVeaZIJ8/AS9Sag1k5cw4GVJ
- TLSH
  T1E8C38D41B5D0C031D4BD19390928CBB59B3E7970DFA48DCB67941ABA9F302C1DF36A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-x64/bufferutil.node
- Size 151KB
- SHA256 9bf6ec4d84b75403a50f22d9bdba2cfb287f12472374c9d5eb736c963a997ee9
- MD5 21452ef6b0cd9fbfbdb622b50c2adaaa
- SHA1 2bc5f964994ab2077796849a4b544b550e2145ea
- SHA512 a9b53bc1f2ec0afac2e3609fd53330aeec4c21f46bec0d96af2922e17e88dd56f8761228d391efe093399deb6d3ed9cb6e0f7358bfd311635474388c25317b3f
- SSDEEP 3072:AU2S5EUeVT4H4i4T/qB1YwTeQrZSmwVZwNRNScC:Xr5UxkPYOeKUF
- TLSH
  T1EBE35C47B3E500BBE1B79679C9A34646E772781107609BEF03A443762F233D19E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/binding.js
- Size 90B
- SHA256 f6610bfca5b4420ec3d8d061fb0a7b8093fb65daaa7c3b055ed49faa6152658b
- MD5 01a9daf263124009f2aeed6b8a2530f3
- SHA1 14ce90f19228d1c1a87c4013b4adfe8c6d996b86
- SHA512 a4788349ef41142d301dff83bdbf14164e633155951ced9439f5a3474486f79671f44ce977f0af0ba20263d81ec5425c8235960c620001cde23b1b3772853b97
- TLSH
  T183B011C20FE83A03330080C0E228020A0C8BE20000000008CB000AE8A0EAA022B838F2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/index.js
- Size 7KB
- SHA256 607e535d8f99cd601b172cdb4844519468e61a6101e36910bff959adcd7f663d
- MD5 c7802104baeea9df41ff061fbe651dd8
- SHA1 2c4849370ecfc7a8e07dc5f0598bdeab7b6369c6
- SHA512 c09a357356943db30cbfdff6d80512a557406bf16936640da44443fa50a98916d4bd2455a56e81bd51826cffaab88736821acac588aa299e0a74e52d66c00a34
- SSDEEP 192:+FfiAo68MxBhN0o68Mm6o68Mnlo68MKVo68Md0o68Mjco68Mf/7o68MtZDo68MTf:+FfiktR
- TLSH
  T1D1E18E9725F07A76474AFC3E908F1109F523D033691E6EA060CCA7702F43668AE935E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-arm/fs-native-extensions.bare
- Size 28KB
- SHA256 85bc986ef4301ac05c261623a521490770e365e98b99c3cb996ff91e5a2a012f
- MD5 2b12b57f562547369ed14b80c2d15faf
- SHA1 e2a7e80d4d2f70a0d4cec373ddb9d40ef99f8520
- SHA512 881eda28ae47bc3203c218ded832be17447cfa444d86e022163584626386736e3d33563cf4c770d76318187b3b8798d9b84e6ec98b3324924facad6eadc812af
- SSDEEP 768:9WI1Lkil9zmnAK3v5ZQqkQ/k7Rq4PHys3:9D1Lki+ASv5ZQqkQ/kJK
- TLSH
  T1A9D2FBA7B25B851FD97426760D9B0E44DE28C25A7543A723ED88F4B03F823ACF85E345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-arm/fs-native-extensions.node
- Size 32KB
- SHA256 5bc621f1528afebad0502b0ad911cebbe853f00e12dcfd360ba74b3fc0f30f59
- MD5 d843f49a8bbc09e314fe98429e3cd1a4
- SHA1 5ef6500baf74100479e3996e057510523ad5ccfa
- SHA512 d5c06bb8c570adb031e5a0372e4af74652ae8d3e2060133c4c163f09bfa72347f3740fb955a428587301a44f4909c1e564549a1dafbb41e6aad7cecb2d5274e3
- SSDEEP 384:eexNl98c6P8W6HG0RVlVhG80lvYRk+bRr64hNsgDAuAQBqiY91xxE0m6pE6Ss0A5:ewYJSlVr0eRk+bYwNLsuVVYHTk
- TLSH
  T178E2B4DBF26E842ED67029734E970F85D91482DA19166722ACCCFC743F81A6CF4ADB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-arm64/fs-native-extensions.bare
- Size 36KB
- SHA256 aa0131a1f1ec1010529e3f0d8dcd5991ee55c82274a53c972e6dde3a588a1840
- MD5 7faa7b323677cab1b6b7e54f074ff457
- SHA1 9b058d6498ed35b0d8f236eb018e9069c05fef19
- SHA512 e762c8e4a242c2016bd3cdd7cfbb7c692150adc98fad669870c82a56b32e12f06b750bc779e0b8b7f5c3f01a5c3c84a7c23e49530f0a895dd5b3f4b2a80306a2
- SSDEEP 384:VblViyBMN/KXTIZnkXG+hoaAyesA1QVzddan0Ux3MTvHQk1/+Qwb:VbCN/KXDoyeDQ5+n0XvHt
- TLSH
  T1EBF2A785E69C9D3AE499B2BC8D8902E5D423B6486B03C1B6FD27D10F79437E8C2DD906
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-arm64/fs-native-extensions.node
- Size 40KB
- SHA256 502cbbf6fdc6dcd23f08e5d41f3c9eec5aab2d4320f6718df569bf4d8672d727
- MD5 8c78dc505d6539476d99264f5a32f39c
- SHA1 941d321b4f7ca9e944abef5f3339257d9c0c9272
- SHA512 460a838a7018ec9348736d4e3696b8e88cb4861f4bfae222263d2868f52e55e5f976bfd29e19d812d1dae73a4f8d64b029b04ce1ab617ba9b4f9390f5b3cddd4
- SSDEEP 384:KTP9bPni17fvmSbNOa/yEpVrlm+MgA1QSHuLwVGVx9XDNgPB3osxCK7QPog/+QCj:TXbN8Sl8HiwVgXDSB4saF
- TLSH
  T1D103B886E59C9D3EE4C9727C8D8A02E4F423F668274281B5FD57E10A7D427F8C1ADA09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-ia32/fs-native-extensions.bare
- Size 30KB
- SHA256 3f99a7aab7b4c4a30ce3c601f3c599d6c94a1b690c27d771b24d996696d4592a
- MD5 6406120e57a519f9c7076a6fea8daf7b
- SHA1 4a9f89840150ccc7131d5b2d93a2258c8f30e5de
- SHA512 edc5f03e9fccc4665c1ca83927c6c4dc7d749f715798616c103fd188b6c656ce607f39d027c579794dcd3214f53c373aef32e90013f6739f64414c77cb7446de
- SSDEEP 384:oIi6VISUuUTOt4GNvSAC3g5be3QCriMTggTjNltlCU1+l6eLLfe+7b:niOUuU5GNFL5y3QsiMTfTRlHCU166g
- TLSH
  T137E2B506B9014A69E974237508BF4B3DC9B4E26A339301CBDF057D2815AB7C487BE69F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-ia32/fs-native-extensions.node
- Size 33KB
- SHA256 6823b0a8fa81d6a7115fc694ef948a18b4aef832587a83d67cc3a365df3193e6
- MD5 f504ff4627334b7ebe43a9c0e7bf745e
- SHA1 e1038b8a53e3f6bc98df0278a7e235634cba7d66
- SHA512 9526fe32ef5c902703b61a7b1a7f942b58045806f905ee74f4997ee1d0cd7faf9cd517a04aaa19f937edee706d971b7c6d157f12d88702c829b1b2dacce042a4
- SSDEEP 384:Um69bPnLUXdiRqM3HNdM1UpbLmpObGIggTjNltlCH8HAsL788fe+fbPn2:UmawIRqMdy1Up/mpObGIfTRlHCcH9ns
- TLSH
  T1FEE2A4077901896DE874227508BB0F3D89B0E2BE775701C7DB197D24189B7D483BA6AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-x64/fs-native-extensions.bare
- Size 33KB
- SHA256 9f5110c03aaee25890e8521433808fd634877b0e4de46a7531b4773bf74c8f8e
- MD5 c1a224bad7f21061388b7e8259925f8f
- SHA1 603098cda751a3a80e31af0b686aec94ddb3d9d5
- SHA512 0a41a604066b938c13b3b7d5569fbc1ade46e62ca0a890c544cee331c0ff301cdf5ad63b383897ca32fc284dfdf39c2105c72811e157d2bc6f2fc986c5b4e97f
- SSDEEP 384:MCVn3uWSv6Z/tdWUxY+TZmI1syF+Oi0L6naAdVWeXIet3z9ZfdD4+KAE4q8Yb:Mm+W9HbFTZmFyF+Oi0vaWePD4+K
- TLSH
  T19DF2C60736718199E88CC5389D1F412951F4F5C51307B1EF6F0DAB302EA2FEA632A6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/fs-native-extensions/prebuilds/android-x64/fs-native-extensions.node
- Size 36KB
- SHA256 9e59e652f7a52e6b0a49cf578ab18b3be646983987bb4e7d91e22965760c3d9a
- MD5 280a963ba011c0e759ebcf5ebd9fdf39
- SHA1 56ad877409dbb05dff666d6b96fbccdb531d6e73
- SHA512 2ef6680ecf5f24e9792a01c1eb7373f234cac23cf4f5e388b0d18334607c60bdbbb5e020730bbee66f7b796b6284940442121f7ea7c5d0cc94ea0cbee5e6b11b
- SSDEEP 384:iD9bPnOrkGrzM087pMrw9P0YLdhSQPAZ5qTmGP+Uvg00mHDoStX/H9HR1RKvSpl6:DIGMt2ETLLSQP6qb+D5mH1lR3plcGI
- TLSH
  T1EC03C60B3231C199E88DC9349D5B462651B4F5C9570370EB6F0DAA302D91FFA623B6FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_arm64/koffi.node
- Size 1.5MB
- SHA256 03d762daa26800a5680481a6798c05d30c3c4764110d6ff70e4bc87822a7f17e
- MD5 a31492a10e72ac617ee472f4fceb7180
- SHA1 d13bebf2aca1bf7392961f5742ee89927dd40a7c
- SHA512 52a6e7b692e305849ce4a8a916437b66898a42d1059eb844b3b49baf8d3f8f929573639c78688a2ee8664a2e4cb26bc2ec5902492026331bf061c55af9f4ef28
- SSDEEP 12288:fe5zg2cZqrI8kBGZTjJxLkb5WnRMDb8geW4Fq7l7oPFtu7sbankNB9L6hAvS73Y6:f1McBSUgnRMR34Fq7NBdSm3d
- TLSH
  T16875FA42725D46B4D3E6A63832B58E275CD43D4FB2D04C64EEA507482FC33B73E6A896
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_x64/koffi.node
- Size 1.5MB
- SHA256 384c2a27faf08b82721613d6880c978716b58edcb81656be787c6b59e9a4134a
- MD5 559ac30d33067771e4243fc39bd53784
- SHA1 14a04d9f611d744bd15e5010920ca240979ce414
- SHA512 88fd7a29b3d69124ffc560346e4eb0931807f076c09662ae04c9af57e2392fce6a519aa91deab907ce4a2e14430b5548ee2e108305c8abb5ec5adedca0251a69
- SSDEEP 24576:3LZHyGzh1hSQEIaXltZzBy8hsoKn0F9Ov1ws1:7Nykh1fEIGZzByaHG0atL
- TLSH
  T11975E106A31906B4E7FEA97027798A2B24D2380776F48D1CEE299B502FC33772B5D954
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/win32_x64/koffi.node
- Size 1.5MB
- SHA256 1305fdf18bcb5e71c1cd0530cd0834b9858beb01606f58086e587343809bfa3b
- MD5 435380b72f8fb5f50205c49eb9e86a32
- SHA1 172c0f5e9106a52da4f4712986a763dc3d24baf1
- SHA512 ad0534f5a20a759b75bb34e599ee4977ac15d375969bbc9b04809f422aa60034634e161bf7f1ec7b8a35a1bb1cbc7ae90c7f9b7aeacbcace5fe44620abf13527
- SSDEEP 12288:t5Cqc498aIdrB3cu3ddm0LM8BpfmrytFNXrfKh41cVRk7S2JbHnukzaaseLnrO:t5Wd/BLMqOOt3rKi1cVD2Jruk/dLnr
- TLSH
  T190750604F76891E9C06ED2704F72D306B965E810437D69CBD29DFEE82E126BD903A6F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/koffi/index.js
- Size 20KB
- SHA256 d895da378d05e71f76e710d07a0e8688b7cd35cebeff8314a1d1c0786789654e
- MD5 bd29e33a14a22d47ca83bbd0e3ad0caa
- SHA1 fa591246eda595228cc1221b1d51987d5dc8841a
- SHA512 5b975aeae9a46010dc69c65147db5f5d071bb432b71a3fb74738163461099ae345f1bcddf9e731401786c4084c2a59e6bbad638fa23730d4cdc3238bedebb5b8
- SSDEEP 192:UIcO3oqiuThaiRED6C3Sjzb81dqBV1mttNWG56q5CdrSW527ia3aiqQ26NXWHHqh:zXyj8v1n4Axh/9OG54VaWnQoMaP4PG0i
- TLSH
  T16292845E4AF720629323B178D36FA0457671C4835509DE087D8C9391AFC80F99AF6BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/indirect.js
- Size 18KB
- SHA256 7d9b09b6fa27158991c5594817eaf7ed4ee01876cde52404efacd6d9482a5d14
- MD5 5c498183c39f3393922c4b3d1ffb95f4
- SHA1 c18b2b4fa0c0a6f450ca58b078facd3a4a2ba788
- SHA512 94378e0d19fe8ae8416ab17e59293f9827875fe9ffb25569d8438431b4303e19b7a7b7962396d7f576a180e4793c90e5351debfbdda51ce2e817a67fa2e00df3
- SSDEEP 192:UIcO3oqiuThaiRED6C3Sjzb81dqBV1mttNWG56q5CdrSW527ia3aiqQ26NXWHHqT:zXyj8v1n4Axh/9OG54VaWnQVM1wi
- TLSH
  T15B82825E4AFB20628323B17D975BA4457261C047160ADE083D8C9385BFC85BD9AF67FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/koffi/lib/native/base/crc_gen.py
- Size 2KB
- SHA256 605109bcb12c06748b022bb1a7948fe5e4c6376bc87b21d232fca9b1d9a241ec
- MD5 62d1c2ffddb8ccf2e4f93bbba7b0981e
- SHA1 88aacce8c861f8ca80e827e21e067cecceb97bac
- SHA512 f67c8a6a171eeebfccc8f17cecdf6ba22611a9f11791fd11d83a00abddabf47af0e071b38236ea80d15bbe91415b784a8f69f4c6a71f1f7b0fbae9117b87d498
- TLSH
  T1914121A29CC466005B0390BC5DEDC922962CB7538A41BDB1BB5D96C71F42A39C3DEC8D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $R0/Uninstall plexo.exe
- Size 201KB
- SHA256 6dbb6f1c224aa34e0ee2a2c35ba079ab72083309201ef56b83f66b5871efe383
- MD5 5b57f3278f2accbd859e560b62e52082
- SHA1 1c5dfebad311c9e1945fea484554e179ba8148a4
- SHA512 8ee9d1c62b9d097b277dce4ce55b8a4fcc3c97c70b4b0b1b8536cd1865da85695cf16e0a6360724884f3e0d08027665a1757d0aac84e67507b09a55efa4db510
- SSDEEP 6144:g740I/XXlIce4E8P4D7eBam2Ua8T2t0EyL+ya+:6gX2ceFvKBaRCLRKJ+
- TLSH
  T1D9140100A3B0C663E5FB0F7057B5479B2FFAB22524688B536B802B8E3E97694DD1D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Reads ssh keys stored on the system

Network Service Discovery

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32