25f41eeb70751edd3c28facd9c92aacc55dac189868ad7952d9266d822a4b504

Sharing

Copy URL Twitter E-mail

General

Target
CurvaLauncher.zip
Size 3.4MB
Sample261102-ff9j8azzet
SHA256 25f41eeb70751edd3c28facd9c92aacc55dac189868ad7952d9266d822a4b504
MD5 c01ffa895f50e4f744159cef8af7c7f2
SHA1 cafbf7d0b4f55a6f9920fd9855eb4887ef0d5d0c
SHA512 0a27a8b1ec9812949934c303a1425a5f1f7b8a2a37c7586763119684e5322264c694e865fb239536951d04836f4d38ff2996ed1820b7e7d0afae0e4b561f1115
SSDEEP 98304:0JZKT6UoizZ+Xump9OgfH5uTmLFBgnCexC2QDTuxZN3:0a6Uoid+X9DOYZlsD4TuF
TLSH
T142F53344C6AFEC028B67B8F1F122770F71FB642789858AC8C5518247B6D67F3EA2D641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CurvaLauncher.exe
- Size 7.7MB
- SHA256 a4f910738f68aa1bab04d6608a527f6fecca0962b1f3cb7de356a2fada990379
- MD5 616584ea8f1c997fd5b1c46821a1ec7e
- SHA1 291ea8d0a85ce8d2aa9d25d08661d2928daa8fb5
- SHA512 d8211dc5edb52edfdf80fc8d835921dfe9bb75422e91eb21037e2c1ba262a32767696866b89ff52bdf10033978865ffa27ea19ec2bd88192e55a0c1920e98da3
- SSDEEP 98304:BXkg1eAN2do5OYoddtd/KGCvSmaRZ+nceNhD94j0AHDfyJrelA:6geAVORdtMvNhD9h
- TLSH
  T10A867D0D23E86D37D3B787399CB073115E746D162102EB4B6E899A1D29762C4CDF23AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Plugins/CurvaLauncher.Plugins.Calculator.dll
- Size 54KB
- SHA256 70e71b37fef23207cfa78b52f6a6ee6e2de029f986ce13cc11c78ea505ddf732
- MD5 1e90e5332a4890b774b1ad101d864584
- SHA1 b6c52ee6cb2e0784943d412db59f650043d50ccc
- SHA512 781e23802dda80d1732f2ed2ee9f9c3d44724debdfbc907c5ef4464fedcb74cec08e59afb92131230575fab1440181ca28e54f7499d3d9a769a2f6d355105a23
- SSDEEP 768:6kDQwIFa5tJWilEPlvzAQH6WvAQZSPdvgA29UqNmqBZB:6kcwIE4uRK4uUqNmqN
- TLSH
  T175433A54672C816BC95B877DC4B9902143FFA1F23701DB2A681CB2EDDD13742AB07A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Plugins/CurvaLauncher.Plugins.Everything.dll
- Size 139KB
- SHA256 a87bcddcbc6f9ab7f6a02a36067134091058e4d8a8e22e7a0192713292562df4
- MD5 25d7bda7c4fc9dcfb41db8f3c02d7203
- SHA1 1bfb87e9ef5a7df994254c2f390489d0570b32d5
- SHA512 653cfa033240ada96ead7ff3849b4fd48bbe78e786b2d985168fac2df9dcf2310fb6bf4e42a49b5cf4d226f1c7b5b22a51d269a4a049346fb29df3b192c35494
- SSDEEP 3072:tfDq88rlJ48CzId0R8nCltA/MdQGf/hUFPKLYSIip:t7TXEuqCt5KGXhp
- TLSH
  T1A9D38D827748007AE9EB8279D4B342459B72B4412761A7CF067C828A2E733D59F3F776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Plugins/CurvaLauncher.Plugins.Hashing.dll
- Size 23KB
- SHA256 34f278bcf7126354ce44070299bbb85054efc4c57610afd4ea705a2eff050fdf
- MD5 57d16575a8fabaec7a1ff15a247ed1a0
- SHA1 3ba2dad9af7f216f97c42d15e6cb9460bbb16cb4
- SHA512 1fba90203d2cb7495094cb132d3110a2963615eec59a09c45a3926b9271e2177b76c97b4c8826f820f82da49fe90b172bb1169574a711d4474799d02a141aed1
- SSDEEP 384:3WQZ5W2vGL510lAu2+2WwpAXV5A2M+4YQOPBj4qqwPhpC7CjC3CGFCGQzwAhjMIH:3WJLYlAu2pKkrwP2W+SvLwu
- TLSH
  T1E9B20810266DA26BCDBB0B35157551E433BBAB5B6B61CF1D98AC110CDC236078F12FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Plugins/CurvaLauncher.Plugins.OpenUrl.dll
- Size 19KB
- SHA256 d9d1969ae4baea92367efd683fe7e935194944188e42508189a8e2465789b395
- MD5 87f0b635d313cbf8535af3263b9764b5
- SHA1 fa0a8f5406a4569fb595f9aec67ba0829455df0f
- SHA512 dfb9cb8f34cb99d848f61abfd67eee857571187ab9e29cd6669a76a3e3675f4977c786ff9d81974d8bb690a5d0b79b381647cf84ed90a40fd604dc817c8513b8
- SSDEEP 384:vj9fg9f63SRCtHWhqnkhMOpA2M5IwePBj4q9Vg7edCUCiCzuCcCsfQchgPh:rW9c3tHGZUAITfh5H9t
- TLSH
  T1AB92F8103A2C92BECDB70B35547911E0237B6B5AAB51CF7E5898220DEC635178F23EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
- Size 36KB
- SHA256 2fd8704de20621b1893c3b8c2eac54ae229e752aaa6bf37a15ee785859fac24c
- MD5 41ce0891eff717908bec753290edc55b
- SHA1 778b1cbc904e0def16ee49725c9dbe8e39582949
- SHA512 e2babce52cb607c5bab58cfd1c90d2daafb311f3895404db9800cbfc7f3fecdfa42e434db7c7a625f74b7b5fbfd1a6efa4305151ede2f5977a707ef7a8a10e60
- SSDEEP 768:yGxBjD7uIxIy1IRIeIw5Vn6qCMDl35es:1fjPuIxIy1IRIeIwDEMZ0s
- TLSH
  T16EF23A50677C42BECDAB477AA57514E0337B26BEB7228D1CC46CB604DC42A4B8F41EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Plugins/CurvaLauncher.Plugins.RunApplication.dll
- Size 697KB
- SHA256 af044719aefa01a55c37142fb23ef220fd4cabfdc922c197ac13db0ac89b8086
- MD5 e04157eddf69336a23a2351442c79bee
- SHA1 f5d1018d33a99fe9c21612a7aac980dc195116af
- SHA512 4ddbc56db9d5472f932f6804680b2e0520fafe89e6bd8f04258ffe93a4f80d0cefd41fce39f50439ffc384c3afad33557d0f4e735e097b3df897440a0a019616
- SSDEEP 6144:QAyqB+nR5jufXHwRZDUWMr3nL725QZTde:cqujufAFGTQ
- TLSH
  T153E4817E72D0B065D1F5C5F239567448DE32822E8C8AD234BB20BF917B94384FA6E791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Plugins/CurvaLauncher.Plugins.RunProgram.dll
- Size 22KB
- SHA256 046b601327329958376c2a23153b1610292ba05e48a7440ef9b985c0c283070a
- MD5 9ff0b46dfc513246a8a463420e97b475
- SHA1 f8168cb4cc9a5e7e61981a0dce9218747384de9b
- SHA512 e6610c661e3a38fa22bc31f83e3bbcf098823f4861ddc3107e0d711185f7ee60ccb001ec8f5ab40109393114e31a85592457084481a105e67e42a3318cfcf995
- SSDEEP 384:U+vxtYsTht8B2/5/PpPA2MDtXxlh6QPBj4qrnOKXn6CRClCoCnCg6PeDERgX:JxBTht5hPODtXxVOKXZQkzCAugX
- TLSH
  T1B0A2F911665C52BACD7B0B7954749091377BFB9A6B018F2D58AC930CFC2620B4B13FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/CurvaLauncher.Plugins.Translator.dll
- Size 51KB
- SHA256 21d3891a471c5ee2439c020f58d4609af0ca73502e388c2654dc0b273a4556d4
- MD5 f0067caa6afa1ef51bc436e3c59df3e4
- SHA1 d710e754d38cdfd95c0e245e1852b0840aa4d87e
- SHA512 dc4609099ac6c9f8c7b0952aab0bb99795921cbf44d29986638bfdeab3009191d76270d9e65b748b9c07dd90ae563af76d1a87215b662141d0d76d594df86573
- SSDEEP 768:0APjikSYujDnP2bW55BjFG1AJoS1gJYBF5WclEpWO4A0N4GdE:J0Y0y4jBGuoS1e4DxlEpWgE3dE
- TLSH
  T164334C60136C81BBCA6B0B746530C5E02276A79E7B22DF5C999C7A49AC1374FC711FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Plugins/CurvaLauncher.Plugins.ZXing.dll
- Size 537KB
- SHA256 46a5ccb4d02b98aa63b0e0212f39521cd2071d6847330f731ed329f16b454705
- MD5 6099ebcde441690fbac4d5fe2a60bf89
- SHA1 f68c57479a05ebd7a3165e8f5dcd6e318ba63620
- SHA512 872fb1167da2e675f75620640177a809d41a0ead038ba7273d16450dc81488dfdf4555dfe17d90013485eded2b8c522a90158802ef1532121f6724282c975043
- SSDEEP 12288:XpMg1APMcFONnNbPm9e/qtN6ffPWk135ScOazHv37lnLQOPw:WnMcQnNS8i6fZ35DzHP7lnTPw
- TLSH
  T117C47C157BDC6B6BC57F5F3A94B10004A2F4E4212313DB6F6D982A692E537C19E823E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20