c6cb6c6a96cfdb7aea05d69f1a2930ec8b219a890cac893580bf5aa122f71870

Sharing

Copy URL Twitter E-mail

General

Target
c6cb6c6a96cfdb7aea05d69f1a2930ec8b219a890cac893580bf5aa122f71870
Size 2.1MB
Sample261030-le7bcsct9j
SHA256 c6cb6c6a96cfdb7aea05d69f1a2930ec8b219a890cac893580bf5aa122f71870
MD5 981c600fef697094a0ade528809ba213
SHA1 a6720f6d8ac4c014572de715e7bc837c5f0fc19e
SHA512 70505780cc30b3f4e5ecf86fa88827fb17ffff92b2462706b82a2ff017d6eb410894a659ed087a78709ebbd2beacc61e420ef7095780c63a39e274eaed410413
SSDEEP 49152:96Cw6wgt487cxj8sMZyv5Zlve8zpCBe3kH4U6uC4M3IoBBPPndAgif:9Pw6BtzOjPTv5Zlvzpk/Hf60M4ojNw
TLSH
T11BA5337134D89390952BAC703FD124D2139BAC04EB6D5E6E60DBB9F0897D4A333AC53A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Firestone - Installer.exe
- Size 2.1MB
- SHA256 a74fa98585380abcae3ea79fba3a0123491e56ad633f2babfbe3d3381ad59294
- MD5 7c4fdd2458febffdc8b3117cb06a0aea
- SHA1 217435f76ee959b37885525691d6886c747db9ad
- SHA512 4c3497f69f2f1a753e36db16d3174fa2a58a9b92747fef72c4b9720fd3ca8edc93915214b130141193fbfadc1fbc40926abd1ebf5ed990522e835fede6b94762
- SSDEEP 49152:TQAF6WxE87vxpsrFpIv0fPHOMCBgs34WysQY2Nh/A3xr1cUx:TQAF6IPN+TIv0fvFUv3pyU6Ar
- TLSH
  T162A533A173ECD109CA11DE703FE24A7F257AFD1029798F87A3C4BC10A92D992774C666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $PLUGINSDIR/CommandLine.dll
- Size 68KB
- SHA256 b6ab16dd1656c7a90c0b24bde5453d761d9eb557b128c73f6ee9345ae6822b2e
- MD5 ccd5f62a1d87970d9fea6d26fd45983a
- SHA1 867942b2a6929ccaae481c02649386a5008db997
- SHA512 5d4653e438d004090ec8871702ea46d743c79b61abd7864b447bf16f60482e2fc991b9b2b1bb071a0501d4dd4ae4fdb033075ec18c5a1b50b0df6fa0092c4f2d
- SSDEEP 1536:nZj9JT17qpL/6ePMqBNzrstoJSkrjbgbwziQ3hwa7PK3h82:nx9JT17WPMqBNWAkbwzifaF2
- TLSH
  T1C6634A2193EC4727D6EF0BB9B4B462250FB1FF86B523E36E8D49A09A1943B4145213B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/DotNetZip.dll
- Size 467KB
- SHA256 6c512d9943a225d686b26fc832589e4c8bef7c4dd0a8bdfd557d5d27fe5bba0f
- MD5 190e712f2e3b065ba3d5f63cb9b7725e
- SHA1 75c1c8dd93c7c8a4b3719bb77c6e1d1a1620ae12
- SHA512 2b4898d2d6982917612d04442807bd58c37739b2e4b302c94f41e03e685e24b9183b12de2057b3b303483698ad95e3a37795e6eb6d2d3b71e332b59deeca7d02
- SSDEEP 6144:GuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/Wo0k:UQL32ikCaUS4csRBse6sfWNk
- TLSH
  T10FA4AE0427EC4B57E1EF5BB5E0B295A2C3B1B462693EEB8F5C4024EE2D17350D911BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/Microsoft.Win32.TaskScheduler.dll
- Size 124KB
- SHA256 f8bff4120506bb32b8c4a6a3e4fa31bc70b365b38cf2aa13b160985020b6d3d2
- MD5 529d605158a6fd888ea989d77785aa5f
- SHA1 abf553c514b6ce60bb95b5b67d65f3a64d3ddf90
- SHA512 f0d993ac7a173ff9e88c1993735e77c4d6db0bf4100bbca531a298c9e7953f6c9a53fe61f006d8ff276d707c24fb4856f9bb4a5ca6f534a1ca86b169c1fe3c88
- SSDEEP 3072:uBCeNh/pcfnLq3wyXYsKRNRwxz+gT37teucRpH0dVrs:uB/w4xQWOcrs
- TLSH
  T133C32A1237EC4D3AEBEF5BB9E525162057F0F1462622E70A8C4CB0D98D173C69E606B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/Newtonsoft.Json.dll
- Size 692KB
- SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
- MD5 98cbb64f074dc600b23a2ee1a0f46448
- SHA1 c5e5ec666eeb51ec15d69d27685fe50148893e34
- SHA512 eb9eabee5494f5eb1062a33cc605b66d051da6c6990860fe4fd20e5b137458277a636cf27c4f133012d7e0efaa5feb6f48f1e2f342008482c951a6d61feec147
- SSDEEP 12288:p9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3SH:p8m657w6ZBLmkitKqBCjC0PDgM5CH
- TLSH
  T1CEE44A0623F88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/OWInstaller.exe
- Size 301KB
- SHA256 c6864deca3c3b77500ad86dc3c847a7430efb0992228625f36ab767d1a8f90dc
- MD5 1333393fbfcea0642f3aec0499a44e9a
- SHA1 7a1ccf2f5d311b7548938ff51ad85b05e03021fd
- SHA512 31a565555d0176f0c87248134b3c64ebfc11f92d6cffb8d7968e99a7d7d74004ac32b8dafd05eab8fc5d33750a12da0e1fd076eb10e3aa123c7769aeee977ef2
- SSDEEP 6144:rczyBUDsrUODYRVxGxZ9bKFoSIm9u0Uqq2zCpl/ucG:roc4kYoSO0jA
- TLSH
  T12364381123FD8628F5BF4B79BAB649248BB6BA87A477E79D0E4164CE1933300C950773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral13 behavioral14
- Target
  $PLUGINSDIR/OverWolf.Client.CommonUtils.dll
- Size 648KB
- SHA256 d18fca59c1d678df61964cccd09ca8594f859dc45668677c95616f3abaca9266
- MD5 5aed88b663a63e0d7d98f1481521e688
- SHA1 2e2ff06bd3adfd3418610d49de9e30570bdc4140
- SHA512 e25c9083a19892dcd8ef53bbf915d5b8bf72509c780a79567752f76fb468c09bbac2b8a9acd6b03954820b09ef9a29f8dea183539f3af4665ef5a5497e38bd64
- SSDEEP 12288:GIdIkrU4WLWY5smdHlAdHBcb1nB0LFixTl7RnAv3:KzlOVM1nBoFYl9Av3
- TLSH
  T1A2E45B5133F88A26F0BE5B35A8B021054BBAF5079666DB4F3A5C904D2FB2748CD51BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/SharpRaven.dll
- Size 80KB
- SHA256 83bccd15b4117050fbda0d6db992efede3cfaee7fdfbe167714b8d8c62a19380
- MD5 20422fc722b26cfbb8d68252ddc70fc9
- SHA1 642792a565ce5cb9a3383cd6e6f96e88af0046b0
- SHA512 c2f8747164c303df05b77e5a03a87b23119617745403c0319b59a1d934f72b8d9c2c9d5ef7ba2a3a130cca46b2d0213b0a3b0e6aa9f8ff3df190976993a8e171
- SSDEEP 1536:1a9qjviI1YjOrfRK9bvyyfpHbnzDwkk7PC3hi:1EuqI1lRKbvyyB7nlkn
- TLSH
  T1AC832B3123988328CF9D6734B078235A67B8625E3B31E696DF1C619E6F973C346211B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
- MD5 7399323923e3946fe9140132ac388132
- SHA1 728257d06c452449b1241769b459f091aabcffc5
- SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
- SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
- TLSH
  T1AC326C05536081F2F5909578942BBB271B3D1115A7BA8F87DFE38483BD282E6AE3D613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
- MD5 9301577ff4d229347fe33259b43ef3b2
- SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
- SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79
- TLSH
  T1718162BBA3F40CB3D0954BBB41A31CE793B2DD702716401F498B568A20C4A6FED5E705
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/cmp.html
- Size 5KB
- SHA256 6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- MD5 d7b8b31b190e552677589cfd4cbb5d8e
- SHA1 09ffb3c63991d5c932c819393de489268bd3ab88
- SHA512 32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP 48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
- TLSH
  T114B1EA1A2D9924690173F3380B6BA204F72AA1A72105CE053EACDE513FB152BD58FFCC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/index.html
- Size 20KB
- SHA256 69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc
- MD5 c7b752acf6d1e10f3aca2c67b1ccf4d3
- SHA1 ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7
- SHA512 120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576
- SSDEEP 192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8D:+WNaM8UnbjPk89+mppHL
- TLSH
  T18E92B7159B21203D7173865EB5E1F74D7030C117E2939E7FFA9C5526C7A618A1A23ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/app.js
- Size 21KB
- SHA256 993f140f9f4e5cdbdcc657a3c159328bf58b3483dbc27c451516a556763a79ba
- MD5 de88fce9253d26e0c61daa1783baa775
- SHA1 07c5848354a247056baad369059aac9d3c940ecc
- SHA512 71ddd47ef7ed7c02fb31e8ffa2ea6d1b5178dbda2ab37bac208e088c8ba2127e0cf5eaa74ee7ad5809fa69e534853312c6c8775c68aeda63bf0e4a5caefa39b7
- SSDEEP 384:4X+ycDQrcljKdZGb9plmt902wjI3A4nzwF52xxYRifG6wBEoR3FGHWdeLj8T:0+ycDQYlOdEbdmXH3A4nzIAnGifG11RL
- TLSH
  T1FCA2738E96791228E972733DAF1F4A14FB32162F15058A273AFD45814F7141282A7FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/block_inputs.js
- Size 789B
- SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- MD5 b5b52c92b90f4283a761cb8a40860c75
- SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
- TLSH
  T14301D2D864D3A87A597DA328536BE748F7391964905A1054F0DC8C64BAF003BC16EDFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size 346KB
- SHA256 630a2295e409485e27a06aac96a49f04d553f3ba299799e26a496776d3583325
- MD5 931c0aea91b1daf5c4936edac6a4ca1a
- SHA1 78c35061126c76a97a42df7b8ca0639ae52712a8
- SHA512 a237db9a0d973d5a07d36b98586d099b4a9277ff125f8cdda52f515bd5d1ce0fe82bc0ca8e3f9396a7eea625e8d8da0b5c39963b580320ca7a6eb5f461e017f4
- SSDEEP 3072:vSDSLzJgixPFNRISHo2kDkNAJOQSPXwGtkLxrtQ8OaxPyf:bxgixP+28kNvwGtspi
- TLSH
  T1C1742A8D7991F0E617D322F5802F900BF37A6468B84D9490B660D8F0ADF95AD523BF2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32