4b7217859bbad6bf77c0d3e1135a04ca22ac5c0c3f15aff6c7f2c0d2f4e9d793

Sharing

Copy URL Twitter E-mail

General

Target
Silent-Client-Setup-5.2.12.exe
Size 24.9MB
Sample261102-cxcp2aet7x
SHA256 4b7217859bbad6bf77c0d3e1135a04ca22ac5c0c3f15aff6c7f2c0d2f4e9d793
MD5 8a2ee81798692592de5a99c7e2986060
SHA1 fead4ca31fc8576788d87f2e26ee7656b02e626c
SHA512 33b1d375db7bf3a913baa23f4d6687f28f2f2429c7046e5a8c0396f75f24a74e7713509d8e9074f5a8803cd201218ebe738d2b11f4bf249e6c180931c4fb4482
SSDEEP 786432:5qpaS/VygItt7k04itrqVVRYcFwPrrdQwgxj7j:cYSUrrqVVeQwjrdtaXj
TLSH
T118473334F69DCCB1E085D1F62E89A93E01093E96F73F91C6CFEB5940DE60699930E522
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Silent-Client-Setup-5.2.12.exe
- Size 24.9MB
- SHA256 4b7217859bbad6bf77c0d3e1135a04ca22ac5c0c3f15aff6c7f2c0d2f4e9d793
- MD5 8a2ee81798692592de5a99c7e2986060
- SHA1 fead4ca31fc8576788d87f2e26ee7656b02e626c
- SHA512 33b1d375db7bf3a913baa23f4d6687f28f2f2429c7046e5a8c0396f75f24a74e7713509d8e9074f5a8803cd201218ebe738d2b11f4bf249e6c180931c4fb4482
- SSDEEP 786432:5qpaS/VygItt7k04itrqVVRYcFwPrrdQwgxj7j:cYSUrrqVVeQwjrdtaXj
- TLSH
  T118473334F69DCCB1E085D1F62E89A93E01093E96F73F91C6CFEB5940DE60699930E522
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2 behavioral3
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 12KB
- SHA256 dfa02ad29e171ba94e2ed1cf67fb125d4b976bfe6ef2258fc2666d811c7e7ff0
- MD5 603fc3c0741ebb52d480e254bfe725b9
- SHA1 b09a8a1fe852832ce14c9c1970e257794b4fafa0
- SHA512 7264b19d3859791d13e98a4abdfa9501742ef4d50e7102ff5eb19158f0f57f77a99ff84482a03d5f698d021e5d8f428059a459119244b8ef49cf17b4cbd9608f
- SSDEEP 192:+1husyjb04+hG13uw0Y/5jiEelSxDObJ/:My84euuw0YhZelSIJ/
- TLSH
  T17D429419BF4745F6E9B39534405FEBEF451BA520DA2F4E0AEB090A09FE77271580E342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 54167ae0968e05910ef8dcd8bbc345afe3dad810fd3c9d2d3f47ad4caffc456d
- MD5 4fd5a2cd0c65c6552fea0cc11938f251
- SHA1 e8f11c1f919eee06f8ebfde989ff53a15243e57f
- SHA512 7703a4a59be8a1e349ae7435f9f3f25698aa774428c7e99cc34a27ce51cc41fe6ca09102dab6ead10fd71e30db14852f12ef57587845ec9ab85e70be2ad85609
- SSDEEP 384:m9YwotlRxnX/+XWmsKP73mwYbhzc7qxD6jT6s6HXRes59:mOrRtXjtWGMqgjW6U
- TLSH
  T19DD2081AFF06C9F2C1E2D57049DFFB77C626B92847260E6BFF1E5E08B8236125909205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 3564ce8b510acfe456f7135e0c1ac1f71cfa39c787909192be8f8ed40dcbe305
- MD5 a396d30099517546b62c0aa673929f93
- SHA1 f3eea24ee7faf86638dfd8c730a544a94716378b
- SHA512 b9d4f025c6858f0483cf34a53d07b60673dcba7e782bfe51a7e00294a87de8de0b5ede4c28bfc3869f2a11dff76a96d9da9dce2f1558a315116f182b73ba886f
- SSDEEP 192:8SOu+kSRU4pMhMoITEZR1w5kY/5OlVcJSUDKCWw6SZS7ZDk7IQH:Ofk6TpMhMoIwZR6OYIlWJS6KCWw4UF
- TLSH
  T15E52D50DBB0A44F6D572E935548FE73F868CA515D66B4F06EF170B0CADA72B1281E342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsExec.dll
- Size 11KB
- SHA256 32d17a3fdb25b11d6751455ba0016996ad3e8be361629ae0f00014734de089c8
- MD5 acdfd014baade204e8812e3e91d040c9
- SHA1 69148a2aecd3c2375c6a0f7e42be9598deef78b8
- SHA512 83040dfa73cdd3d865d40376c0c717726d33cd5a181ff741b2aeed6b340a8f4dec8d2183e7974ea9a736f9fa7402aa03acf46e0ff405da377653687393aecc04
- SSDEEP 192:3Ctx9hs0KyCObu3Oad9z3Y/5wUcW70HgnvrHy:yx9aKCKu3Oad9z3YfcW70Hgnby
- TLSH
  T1B032A7C9BA0479F5D063E538B18AF12F495D7C31DA27840AE99A5E39BC2F5E4470DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14 behavioral15
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17 behavioral18
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.8MB
- SHA256 00c6e5a7413c37753bb92e176539dbf691a101846a622e00a9faec3f23e2816b
- MD5 efb192170a79be23ed2d5939fee545b5
- SHA1 eac27d80d12c51233d388c83e2076241e7a99456
- SHA512 7e2822eaf1585039959b7f2b9d3cfc5c8122ea6ce0470acba9712ef426966d16366c06c35812b4f27459dd6a3968f665a78377cb5e4448a338262a0449035179
- SSDEEP 49152:riGF3GTlZlKgXGXBgfoyTYC5RrvMM2G1t+So3PlK:rihTblK1XBgfoyTJlP63NK
- TLSH
  T15B95222137D04035E1B31A3155F68AB25E7EBE314F6959DF23412A1D0D30AE2EA76B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence privilege_escalation defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral19 behavioral20 behavioral21
- Target
  Silent Client.exe
- Size 36.9MB
- SHA256 4abd196e1e1a9063fe19b4ce1ae6d45622fe2b5b5868dbb915a0a18222281cd4
- MD5 74acebaf395ac27cf94998366e575bee
- SHA1 6ec85773f8b22687593309fcb9cb95d66c7a3276
- SHA512 e78ff7881d1103ac2a4cd1daf4d19d6645263b47c3d53906e11bfee8fbb060189c7db090e065d05cd2294099a07c0b6427086f68e747f59e1fa166aefdfcfb7a
- SSDEEP 393216:JCDW/pTZNJv9csV01a+iG0vIlLFNFMkTgXPXuKXWbvpUoLKsnwkHCvgMq5Bi:JVBIsVZG8eFHnTg/DyvpUo+KL6
- TLSH
  T1A6879D017E8A59A9D09DC870C38B8AA79E3130DF1935B5BF44DA16392F7D7B49F2821C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral22 behavioral23 behavioral24