412b64709647c8bb236190a80616642c80a7ce124f271853e21e52c03dd11550

Sharing

Copy URL Twitter E-mail

General

Target
CurvaLauncher.zip
Size 3.4MB
Sample261102-fgasaahs6k
SHA256 412b64709647c8bb236190a80616642c80a7ce124f271853e21e52c03dd11550
MD5 4105cc7658bf498e262e17520b62584d
SHA1 54e99f94dcc0ad79e5be8b8a0feed2a0d0d45a3a
SHA512 eedaee5670a54e6a6e6f15fa3f401366c1b91940a0426f779e254ccbe023640b0b5ba366a4d94d41316f918c2b20f40db4e0f759c315b72409292842e0c5310e
SSDEEP 98304:BKzJzolsTS53Mn7QXl9fnhkYof6KFJ2i5LZ8G1:6z/S53Mn7Q/pkYcvnL11
TLSH
T1A4F53363ADC680098CFDCDAB93FCD931B37D66292A56EFEA34B5C453E4475A10D4C228
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CurvaLauncher.exe
- Size 7.7MB
- SHA256 6ec27c2fc4b6f4e694e316f9b10528aeb392a148edd9fcd06b636476071390d6
- MD5 e63009531a34a412d2bfa66897ca3d0b
- SHA1 dd4ec3e98c491b8a4522b78ef2040d3deba20cd4
- SHA512 0d65ff919b2de771daafae82f05453ec9245b2128007dcd70bd582f49a8e2d3a2417f18aabe59bce777eb723c38737f7646e4a2f062e9993954a7a35bd9afa41
- SSDEEP 98304:APg1eAN2do5OYoddtd/KGCvSmaRZ+nceNhD94j0AHDfyJrel0:QgeAVORdtMvNhD9B
- TLSH
  T12A867D0D23E86D37D3B787399CB073115E746D162102EB4B6E899A1D29762C4CDF23AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  Plugins/CurvaLauncher.Plugins.Calculator.dll
- Size 54KB
- SHA256 7f337bee5011e2a3f7ed251cf130c9639161ce152915cf46a02addddb101663e
- MD5 56cbb5e3e8c86472e20c3204628e5d45
- SHA1 5e8592ebab57d89b43a834ffd69276e9e298e154
- SHA512 998b055d84d4e142106f40bb7aa3442fb5132d370da7a159a3d3056934f00c673e195568d45c16f916fba47b83a095e6761c787976659442d3d04854f488e1cd
- SSDEEP 768:4kDQwIFa5tJWilEPlvzAQH6WvAQZSPdvgA29QqNmqBZc:4kcwIE4uRKMuQqNmqo
- TLSH
  T12C433A54672C816BCA5B877DC4B9902143FFA1F23701DB2A681CB2EDDD13742AB07A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Plugins/CurvaLauncher.Plugins.Everything.dll
- Size 139KB
- SHA256 f237ea6bbe4e649fce10f432ff0007358857235967fdd76992bcc411f09a72ee
- MD5 7765ecbffc63436bc495a0b9a926867f
- SHA1 963cdd5651f8b3e5a8eb66fd7cb31497bb670753
- SHA512 b7dc8116d794b6fe84169c431cc32ff024b78d0d54d2f817242c7aba0638306b4cfa8d96d9ba56d9b49eaee57ce4807ab0072fcdb7d1a6d5c8d3204e76d4fc35
- SSDEEP 3072:XfDq88olJ48CzId0R8nCltA/MdQGf/hUFPKLYSIii:X7TSEuqCt5KGXhp
- TLSH
  T18BD38E827748007AE9EB8279D4B342459B72B5412761A3CF067C828A2E733D59F3F776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Plugins/CurvaLauncher.Plugins.Hashing.dll
- Size 23KB
- SHA256 e46a6c67810e0f6b99fca8f958063e6d50620b664d61bae1546fdf80dd2689f9
- MD5 4d3d081dc1eb29c06ec0c5b5cefe8f18
- SHA1 9f31c5aafd02e2be02e665b2491088448ec4e308
- SHA512 f1c18fb93516e7e7c9d03e5e688309bce89ef352e18f7c3501be3434bec5c183e6a1607d21a3f7a30d0d3183347e519369741442132da5a96a5a8f8a18960e45
- SSDEEP 384:vWQZ5W2vGL510lAu2+2WwpAXV5A2M+4YQOPBj4qRwPVpC7CjC3CGFCGQzwAhjMIf:vWJLYlAu2pKk8wPSW+SvLwK
- TLSH
  T12FB20810266DA16BCDBB0B35157551E433BBAB5BAB51CF1D98AC120CDC236078F12FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Plugins/CurvaLauncher.Plugins.OpenUrl.dll
- Size 19KB
- SHA256 a7e3ad4d2606922201e424956bfe2c09d7e2988d70068434e904bf8164e9dbfa
- MD5 34e4cae2c82ab4072c54cd2e98bd1d58
- SHA1 7e3a741a3472d5c4c310223e46fa623173ee666c
- SHA512 db7730e7560587c648b410262b6ddee4f0cc463e6147ad4bb9d0544199176dc3ce6cf56ccbfa3f5a019b140199740299268ec4909468d15c3d9ea0a145af6d6b
- SSDEEP 384:Hj9fg9f63SRCtHWhqnkhMOpA2M5IwePBj4q+Vg7+dCUCiCzuCcCsfQchgRh:DW9c3tHGZUHIzfh5H9n
- TLSH
  T10F920A113A2C92AECDB70B35547910E0237B6B5ABB51CF7E5898220DEC635178F23EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
- Size 36KB
- SHA256 1b97e5208bf69b096dee9c2ca4dab75350bc4cca4ddeea7f4d9f05cb0c0d0891
- MD5 02379b55ab8e084610fc44278caf4d17
- SHA1 36e5eb9d187250988800c5ba5aa6849f86224f28
- SHA512 4a90c279d0516da46210ab34dc99bf4b24149eead504d100bd34bef5fd0e41c9eeafe057bd23aaee946e45b9a99e16f2a6191ab70563822dff118b2d1cc0d231
- SSDEEP 768:6GxBjDuuIxIy1IRIeIw5Vn6qCMDl35gB:9fj6uIxIy1IRIeIwDEMZKB
- TLSH
  T114F22A50677C42BECDAB477AA57550E0337B16BEB7228D1CC46CB604DC82A4B8F41EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Plugins/CurvaLauncher.Plugins.RunApplication.dll
- Size 697KB
- SHA256 ed21381843f4e9b066fe3b11ed28150d5ee18b91e6366e3ce652bcdc832d9fd4
- MD5 309e47ba37c68ad950a7962dc5bd178f
- SHA1 3cbb0b5591c0d1b1ac5c71a76f0720158b584212
- SHA512 82d1b080fd18ce92731aaee2b0d6140642a1e987e977d602c788bbcb6d28d049b30ed697aa4bcf123cb522a6ac6c5cd9ee49ff4444a8ea55465e4d10dead8491
- SSDEEP 6144:vAyqB+nR5jufXHwRZDUWMr3nL725QZTdv:XqujufAFGTJ
- TLSH
  T18CE4817E72D0B065D1F5C5F239567448DE32822E8C8AD234BB20BF917B94384FA6E791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Plugins/CurvaLauncher.Plugins.RunProgram.dll
- Size 22KB
- SHA256 5f4f2f846588c962791037b66a66727da9274edc9b0669d971f5971dd893d352
- MD5 d133fa34d15c0d4d7309f48923d46b43
- SHA1 9aa10634d2bd799c6c772ff9080baacd2f489d7e
- SHA512 caf3fd9cfe86c2f4b83258a62c3be10d2752900746a10bdf3023a4d8f50da199c20223ed21ed12863c149790af9b134a8e245b2259563c8fec499f434e0bb9b8
- SSDEEP 384:/+vxtYsTht8B2/5/PpPA2MDtXxlh6QPBj4qrNOKXn6CRClCoCnCg6PeDEfgX:OxBTht5hPODtXxPOKXZQkzCAwgX
- TLSH
  T117A2F911665C52BACD7B0B3954789091377BEF9A6B018F2D58AC930CFC2621B4B13FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/CurvaLauncher.Plugins.Translator.dll
- Size 51KB
- SHA256 2f605ebd4bfda93d07ce1a29ab7b19b7aff93461e93aae60dc840f9db491e407
- MD5 9d39798bb49d77f7d1c004bdb4c24e06
- SHA1 87412dd7fcf0ea53ab78d1c0a217173a4cd2ccc6
- SHA512 5105d6cb673f01cfa3049ac4d34c2174b1dbb873059dc73e0972fdab6995cf0ebd6f3212c735fa2fe7597294de2f7d02744307771fb20052312740e0ef189691
- SSDEEP 768:rAPjikSYujDnP2bW55BjFG1AJoS1gJYeF5WUlEpWO4A0N4GdU:Q0Y0y4jBGuoS1ebD1lEpWgE3dU
- TLSH
  T14F334C60136C81BBCA6B0B746530C5E02276A79E7B22DF5C999C7A49AC1374FC711FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Plugins/CurvaLauncher.Plugins.ZXing.dll
- Size 537KB
- SHA256 c692177cb29b57cd5ac70df5c7463ee3986f3682912ac9a9eee0891e177a2692
- MD5 5c8051fc88a62ba2f1fe548cd3ff4a08
- SHA1 ba311b35b01b6c4a5fb443984858db41572cfeb7
- SHA512 2284d05fd2e49eb977178653fdd43d5cd6aab4efdcca0b95256e891e46d449cddd2d528600514ad4dc3da5a1de1a73e17b1a655d8f7fcd1a048acf2d9261809c
- SSDEEP 12288:JpMg1APMcFONnNbPm9e/qtN6ffPWk135ScOazHv37lnLQeP7:YnMcQnNS8i6fZ35DzHP7lnPP7
- TLSH
  T16CC47C157BDC6B6BC57F5F3A94B10004A2F4E4212313DB6F6D982A692E537C19E823E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20