67cc952b11dc9640431e1b4911fd572285a28f37303443e61e3cfa487c73f772

Sharing

Copy URL Twitter E-mail

General

Target
NeoShell-Portable-2.1.0.zip
Size 72.1MB
Sample261104-xgp1msed99
SHA256 67cc952b11dc9640431e1b4911fd572285a28f37303443e61e3cfa487c73f772
MD5 4e766fd651e24f9a52bfc5b5704dcee9
SHA1 3fc92566da3cebe96d367e3f3b697a3936ebea0d
SHA512 fd9535a56d07df863c21682fca01ca3f2e65d85ec8111997cbb2eceaa3718d95ddad4a06a14d336dbbf1840dd2b7595aa76419c08ee007fa8844c064850a7b12
SSDEEP 1572864:J+WkQJDxdhjjTRYCxSGaBWajQ7OqlF7EsPPXBULAVJk+QKc:fkQZZRYLGaBWajQTOKXYV3Kc
TLSH
T13FF73363FFC5E06E24166A0391F18D0896D632CF4BE1621A318CE7C8C927A9C7D69FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  NeoShell-Portable-2.1.0.exe
- Size 72.2MB
- SHA256 2f3f35a440f10f59d5227257442eb8c2ca855c31cf8fb2789ffeba7671e0eae1
- MD5 5009b989eee61e24043c721295ec1bb2
- SHA1 cc4fce52a39ac543e02cce4b0f2b6b1c5474ee51
- SHA512 3fe3751d9beb250e88a044c0438a5596d477126e6cd4b791d9746e54ba248efa496168b5939399e511f4812630ef99242f564ccd171dcd45bb9d267e6ec224b7
- SSDEEP 1572864:J+e4h7TL9BHQwCXkJ0aBcSrufGanp7GgtHPpKXmPX+1qE7:ge4NgwCy0aBcSruZkqPmtAE7
- TLSH
  T1D2F7331EA6C2D05AFC9E77338BE3451E4FD636CB35D0513923E8A34B4522A4BB8D49D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- TLSH
  T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  NeoShell.exe
- Size 164.8MB
- SHA256 080a90993ee9b0e66b02a4f469c9a49f7c7769d6773c1456791021650520aadc
- MD5 7d4af5b3461de4bbdd5698a8b19848ed
- SHA1 8eab8df89c7bdcec6a8071fb1e9711edb619084d
- SHA512 8b321cd346dd516a911b620300e9c41012fcfe2dbfffb6bee8c69bcfbf969c8c0aefd6325ca9e3bf1e3b21fff929df7955ca3ec89cf635b9562e2106e2b1741b
- SSDEEP 1572864:kmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:6sFWY7ihS4kVP
- TLSH
  T13F888B03E29650E9F05DD1B18B978236EE72B8861738A6DF175417262F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 9d1eb0c6eb12bfa87e74a65c2fde5d61c4c93e21fb0800bbdccb6559527036a5
- MD5 14e00bf1d9d0df65f8b1a31240d474a8
- SHA1 f9fe033725b7b1b5c0efce7a14ed7ab223cb32e8
- SHA512 652724450296a739de802ba8fac482953146f37665718446e448a350295e1e7b09bd460835bcd0ac26b2e54bb9b791624a9eea11e6c96573c7c4aed22450ed14
- SSDEEP 49152:IF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQ1SCu:IFvSkJXv+tiLAD0+D1S5
- TLSH
  T1C7D5AE07E6D940D9D01EC070879FA233F62134468B24A7EF1A9196252F7BFD46E3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 477KB
- SHA256 9cfc3001191e8b3eb9c96ba29e57e5bf9aaab264e83897e47cb968167a8a811b
- MD5 1dcf5ac3cb0dcda9c9679eeb018d01bd
- SHA1 bc21697c5665aab5eaaba61f55719d43328f7e7c
- SHA512 47d8769bf00cc7555479542abf5e0684799e424d9801dad8c6bd199680d9c40cfa2380d969515db7a0753cf6f3a9733b5afb931fe33863fe30a37092d8dc96b1
- SSDEEP 6144:o8hd1BSjuMmof2SEXVVfgV8hxN7h2NIIEOg51f0FticyQ:o8DXSjZmof2SEsmN12NIIE7f0FticyQ
- TLSH
  T1DCA47C15B79844A9E07BC470CA534652EE62B4960F65FADF0394923D2F7BBF81B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 80c2ef6ca6d0ff4877bd0c0bc082ff19c3a5002d53648bcf5f54368560f9a411
- MD5 51378647d290f3a08affa8454a3d59d5
- SHA1 32152a6677c82ea9e2e842baa907d708b46a6779
- SHA512 ca90f5131d95fdb1e4a5cb7cb2bbef08676f70367b255270871754f776937994e34258084bf46437b25e1745728c279594d64e0718643eac0ac00cfc43d2c53b
- SSDEEP 98304:1aUIRsMRk/yUt1ngliXWeamn0B8LfdAbvZ3gtT7:1anxRk/Pwzedpag1
- TLSH
  T139768D13F69640D9D05DC2B9DB579133FA31B8950B20B2CF2A9427212F7ABE06B7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/ssh2/.eslintrc.js
- Size 73B
- SHA256 df85748adac0bd2d13fb6f3b3833d3cda0429e60296a111057dc05fbe3b00025
- MD5 4845ca510ae2961e531fa41faed9d7bb
- SHA1 f1c0cea2250d6e538658ce3b833d5505e1db1d80
- SHA512 367cedcb213dfcfbfa9a21afb36970064db1a9e7e57a9a0e7b1e9370a51142191ee183788fba9529d80598f9597dd823810d9b0e24ccf0d398bd48e5333be329
- TLSH
  T139A024CF0034D7D3030444C1D5005443D5CC01F10407D41147F4C744030CC4F40504C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/ssh2/install.js
- Size 710B
- SHA256 52c970cf01ed6e93f04300a2e9f68d1b9a00a4d0dcfaa77aa5d520fc8e2a0a73
- MD5 4b1149f77de8b7f90dbc1967b4705f10
- SHA1 df90983b41fb921c9ef0402c6647593d9667a1e8
- SHA512 08686ca2cd3fb8df28a8c7b5af3666831515f624ff1025fab7a3689d423085b1f8a20ba73a5dafbff5d935ceae30315c7698004cae8642ab8c64bf3511fd7d5e
- TLSH
  T14901DCF8CC2FD77B03F120814438D3A3DAA7413073C9B4709609C1852A8B55AA5FB5AB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/ssh2/lib/Channel.js
- Size 6KB
- SHA256 53e92988a025009b192b72be110bd240b5653f88dbdec93e515e3e401e7f94aa
- MD5 54b15fa9a2480dbd86595410341ad0a3
- SHA1 76cd2594a8432d254225fc563e462bf60554afc7
- SHA512 fe351d6431f13560aa8629ab865538bcf230b104ced81306f018af5991f1ccbc88677151c1ec4fe6d9dc2a25b816b9b2cd3764c4cb8a4c4882c7ef85b126a7cf
- SSDEEP 192:3gPsNNMNxV8epeyTKgIP5GQDM0/C/C5Kd1pvm/cQ+yitfw1X:wl0omMCKKcd1pvm/cbh9iX
- TLSH
  T1A9E1FE88E7B70066827260650FDF1911273AA41FA917DA1C794CC2D8AF9C1368BBDFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/ssh2/lib/agent.js
- Size 31KB
- SHA256 cc6987488bf45f73e0ac5d8bbe59912b70a144cd73b53c83919f188f4cc3f2be
- MD5 4f928fb220e194783bb7dddb525ff687
- SHA1 6639e5e4d93cc283548ed6854d0f423326cc7297
- SHA512 82c332ba7d49db0bfea15746730c9cca1dd34902a5723773cc51fbdbe4bb8c2ec33852fa6f620025abae9dbb02b6f4b51486072109ce177d3ed30ff8ec62c6c8
- SSDEEP 192:Omk0doTcr8dTEasgp7Ug/1ZHc28XXkeXGXORCycCQ6q4xu4i5QiVZAVLRK/KvGfL:s44doalxjUf2/yTivfdXrXVA/axm6J
- TLSH
  T19CE25105ADF72567923324AE4F8BA024B2349017325CDD647A6E83206F85A78C7F5BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/ssh2/lib/client.js
- Size 62KB
- SHA256 edd3484daa9d942bc5a6412edc9cf11f85df40b2db10b07877bbfe694beac7f4
- MD5 30c854d075104050f01da5921df98eed
- SHA1 2c27c05139dbe7ce4822e6b97ff63d9867cd3a76
- SHA512 c8e2a447c3c2c96d877ebf277dddbd6831c75058143308bc44dcb6c98436860c77a9b7b07e7899ed5f4d6e90c8199da5537021539a2798af1ec34c52074bc7a0
- SSDEEP 384:gH0LvelXez6TMamCZRJd9g7iDxpKxU9NxL1:S0LvgMJCRIEKxINj
- TLSH
  T1DE5360989AFB24224233613D8F9BA0167338D4172508DD683E4CC7A4AFD857897F5FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/ssh2/lib/http-agents.js
- Size 2KB
- SHA256 477d34701116572f2af06ac545994f3e2d2f14b26c5ae76bff2b13de2289339d
- MD5 e90ade66c6a686afe6c7881bafd28669
- SHA1 48c2a28aca7d5349674131ce79692585118b3589
- SHA512 05d62973c7745dd4c03867a868a9587c179d0ae8f23f66d4a950229bd13f013430f13f2e8f7511b1fcf5dafaa760a49a26de8cd04e29c81b593501df2fb9dabd
- TLSH
  T107412F0925BB112403F364F6CB8BD90D72B69513310BEA4036AEC2D8AF9056C86F67C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/ssh2/lib/index.js
- Size 767B
- SHA256 27e942aba52a13d7b72a846a4b3fd98d69b65431725b651e7523b74499a2ed26
- MD5 6b94ee4dad05ed6ef8685656b6024d68
- SHA1 6c5d1510a77a9aba743748ed50379f6d9192bba3
- SHA512 cb854309d25cc4cab1d85d9cfaff85448380f9a842dc0e7d9c6e7fe7d2f8454ec80e53fb3783fe00509b4f4d824b9dc6b75e864ab37a6b033f8d4f583439d8d7
- TLSH
  T1DF019C409DE2B68EB5C24EC49EEA3252B1C6C3096608BCE1B03C5076378E44B0A71F2E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/ssh2/lib/keygen.js
- Size 17KB
- SHA256 03d0be43e78ca4f82d4c96d084a39c0242f9c56f343da17a819f8bd0d873f06c
- MD5 4044cede88a77ca08a00038307720c8d
- SHA1 693f7c79ae070d9d6a529a70cdb7bd3933be1919
- SHA512 b39628558fd9c0e21192e0fc39bc17183488449df1deaf6bae5ad2f94b5a62b4a7648df876a314d9bf00ec807a3748996badfba9ff82614a0815d4310b682bb9
- SSDEEP 192:MXpDasMypYl1IcbvG4UQh7nMo2TRfUcLPqOOsGHkMx9PeiZgjXmYVYYRsQQOykbT:MXPY1Iuv97mTqL1VKYWdFykSK
- TLSH
  T1A58243500CF71A24D13390BEEFC3F406E678640B5E0DE495774DD6552F8AE8892E66E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32