86e9f75e6bc9cbb480f7fcbbe68290a846c9c31d3753e146751dc57fb8aae2e5

Sharing

Copy URL Twitter E-mail

General

Target
MALVO-Chat-Setup.exe
Size 116.2MB
Sample261102-mpk2jsvt8n
SHA256 86e9f75e6bc9cbb480f7fcbbe68290a846c9c31d3753e146751dc57fb8aae2e5
MD5 9866c17285464b923642bc6682182ca9
SHA1 bfd2b7715a7879eff6b7deb640a7a98a5bcfc693
SHA512 a3584d4bf4e1b8a85eff3f91a3c0be2c30267db3fc968cb8b914be580b6b946cb9d0dd79c1bfd9c8a65ef74b59968f2ba163b8d09f532462c483470f8550e252
SSDEEP 3145728:yHb1uhsLXx8oObe1XfftB5Z4siSmq6ia3:Qb1vho2pZNiS7w
TLSH
T1E148330187D8C131CA21DBF9C6D65110B9FC9E9ABAE86903E7FE45960DCD063F36E690
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  MALVO-Chat-Setup.exe
- Size 116.2MB
- SHA256 86e9f75e6bc9cbb480f7fcbbe68290a846c9c31d3753e146751dc57fb8aae2e5
- MD5 9866c17285464b923642bc6682182ca9
- SHA1 bfd2b7715a7879eff6b7deb640a7a98a5bcfc693
- SHA512 a3584d4bf4e1b8a85eff3f91a3c0be2c30267db3fc968cb8b914be580b6b946cb9d0dd79c1bfd9c8a65ef74b59968f2ba163b8d09f532462c483470f8550e252
- SSDEEP 3145728:yHb1uhsLXx8oObe1XfftB5Z4siSmq6ia3:Qb1vho2pZNiS7w
- TLSH
  T1E148330187D8C131CA21DBF9C6D65110B9FC9E9ABAE86903E7FE45960DCD063F36E690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 5.4MB
- SHA256 7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b
- MD5 3f5d5669497c9d912e5f0412611f992c
- SHA1 4294658fd6a5be492b8745b6cbfca923f7344b2d
- SHA512 e2c2084a34dec1b1009852dcba37912af48140e127029e84c73021d26b724d679b58f8fba2bd9319e20d026c52798401ccbfdb883088992df0724ec82dd7b22b
- SSDEEP 49152:jCrmWndoHTYp22kuCenUBFIdACi4WMEAUYw6cif:+
- TLSH
  T10446C66B7E49037306F282616A47A5CAF31FA03E3B5A1654309CD1182B7BD2583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  MALVO Chat.exe
- Size 238.2MB
- SHA256 2f171f88eebb4ba1bc61565d9f7350ab6a95940dd15c71d82987fd55544bf545
- MD5 4a9144eedee69c872a0ca705b890a8f5
- SHA1 b3fd3ddfa939b483b281dd1fa6ab29e6b214f772
- SHA512 d4e1b937789a06bdb5d5fc979b5f21d9be779127b63caf4353d29ff430822408546651752288270c52d37a0501b8cd3b13f6ba41e4a415b0fcda7586698118e0
- SSDEEP 1572864:ny4L6/7gC8FmKiW4MHq2xBi+PufAIarXSxR9K27nlnURui+9DaA3yQ2LIV67+kwv:yZJ8NVaE6xPRCc8
- TLSH
  T1FCC88C03E29641D9C05DD1B95B5A9633FEB1B8094B24A7DF2B5407522FA6FF82B3C720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 f5c95e919b4ffa1ac71049cd45b9f986d2965e6888395ca2806337985334fa56
- MD5 f7b785e9d2d7a4ebd6374a555063a100
- SHA1 da162478b19b05fedc9d8027bd182f6beeecdeda
- SHA512 a287e97b14d1f66783e35f295dc0f355a1da1215aa514d307a01d31b12dd29cc4e9f591281ed6b4f9d8fc90fe7d647ae7d2ef0ad2c989c9dae2123462006776d
- SSDEEP 49152:7MaW1H1ZcPsk9HOJLjJP73tSjPM2gjg9aIhR46LUbOWHHJdsCIdkTYoHjnTVyNMx:0cPsguxj34bwmvD3emt3Dnkr
- TLSH
  T148269E56B7E850E9C1BBD138C687861BE7B1B80513305BDF02908769AF73BD16A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.6MB
- SHA256 f9423f08212401e1a8f4b3213c6ebb1b9a37e212f0533e5989d90780141aa35d
- MD5 2af313296ba9326bbfd946192cbfde94
- SHA1 619fd16b618b9d9428370191c5e6d894eb606bd1
- SHA512 ec55890e0f159b724a2acdba9fe68fe94c2067b0a1808f7401753873799ad631dbc2383f19f690f82f56af0fe536909728c8f0146443622ab3620866f9a0022e
- SSDEEP 196608:q5faNqRBapQMnU9aAzYrmcgcuYe6y6nqaESmyytjkP8Z80KFqmP9909KTAq:GamBaCMnK9krGcDy6nHESNHEe5Aq
- TLSH
  T1F74729122646D49CC099C879C7678B268A6C30E73FA7B9DFC0F461212B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  electron_wer.dll
- Size 415KB
- SHA256 9ebd83426b4990f66bf2bff1537e102e6b6517cc7d08141e9cec1a411dd8af68
- MD5 734a621f68e29590bda9ba98de24dc40
- SHA1 4a7e8955ec360cbd80a7c92187a11a3b23461041
- SHA512 0cd09795163e8d01b032aa91dde98ed806d1055f945a13136e0f83a37d43bee6954588f725893b934248b6f5dd194b44e5311483a3de591750e89bc508f2f59a
- SSDEEP 6144:PPhloWDpJZ9MJAEpccKZtZ2tt4PWRHpu7AgVyPJSfUj/ajgVX1:nEWx9MJAEpcce72tt4PWRHc7tyRSf
- TLSH
  T11D948E04F7E448F8E07BD0388A278646EF71789A0F61E5DF03A452692F37BE45A79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 f035e9879a6d43519467a8d761d2ea643ac63ed89d448eab9aac86bc38c4809f
- MD5 4564d6c38964a21a2015b8590bfbbbad
- SHA1 b9600c7b57f47bb9f107d426f790b08002df2ad5
- SHA512 9717c13ee1037d10fb344d6cc9cd02df582a1cec7d4d09bca4bd82f95ff0dc2c536f2f1f73a742cf3f2aeff2206cc58a78b71a2a5431594c96437c59310d025a
- SSDEEP 49152:yjIDphImac+jNpD+wZbT/UTiD7NyzuCmKgc5mar9Yhp1kY2gVek3BYYwxIS4y+jG:ZgcWd+wZbT/n2uAISf
- TLSH
  T151E5AD03F2E651E9D019C43497AF9323B674780A8F1099EF17905A252F67FE86D3E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 2601880d950b0f76d3d44b2fa23b9076b722c2be6f2d1e2972f1c1c2cf176c16
- MD5 737fea1a5268641e84e8fea59eca6b65
- SHA1 6c26c6481ebceab1de9c06b1944f0458958c3615
- SHA512 9bf5b1e64f6c40fa85ab2fd2e25b74dd1d0af0e8b08b6b46380a3656b06f95ad42e3be5d804c880baebfa5f80288cdf2d26884b49a55274e3511f882cca19147
- SSDEEP 49152:4yQV+ED3w+TN8gHV/xmBtJmG6cHExWl71PEX9KoFyUewJMGBxeKreXcdWVT90ewq:4h+ED74Qauw0dHUtDYZPF2
- TLSH
  T117464903F28581E9D06DD579875BA633F672F8840B22B6CF56A00F192E6AFE0673D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 f23002eefe4824cf6724d7ae63e9f2dd1f5119d53a64b542394ab528c64b0d2b
- MD5 d3bf60343d808b223b11aeccc19c4da3
- SHA1 f0641beb31fc3a3556c71488bc96db72163ed30e
- SHA512 6dc99ae5fc7da3d61aa3f02106e7795ad125c13968a36b2dd33442e3eccdb6d20bb1f50c7a54c560c809a04b54ebd8da051dc542403a89b8674b5f04ada81e4d
- SSDEEP 24576:/AxappHEzMkbFnWOj4nfg+K+ySUKNlC1E+Dkw7+Dv6g3v0TAE7yoeHbPez:/AkpuPbF+nfgX+ylKNlC1E+Dkw7+Dv64
- TLSH
  T15F157D53D5948AB9DA7B8038CCD5490389F274A11722B6CF02B817142F5BFF46BBDB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  $R0/Uninstall MALVO Chat.exe
- Size 220KB
- SHA256 6de39dec672ca3687187839984f39468af460cceb48b2baf9e0f279f6d061a15
- MD5 006d37ab4d96043ade8c4c08d13cbd27
- SHA1 0a853ef8c294940f7b95c5acf82d96f6baef49e7
- SHA512 075d71a2707b1990d158ab24b7dd6305ef9795846e08923b4b7005fbf2730da1b513c4c57277bbd6d1ae9cf3399153eec54061d682bd7d14550a3a4ee50d10bd
- SSDEEP 6144:x740IKDAe2j/zDArT//VBUa8T2t0EyL+J+a1:JzA5j7DWT//bCLRKv1
- TLSH
  T196240128B3E0C56BD9F70F7017A89B9B16B1E12521784B8B7B84231D3D92791FD1E782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral28 behavioral29
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Discovers running processes

Checks computer location settings

Reads ssh keys stored on the system

Network Service Discovery

Discovers running processes

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32