671618fbef43b2440501c34c6093f29af39b7350beadda147e144a05113dcb48

Sharing

Copy URL Twitter E-mail

General

Target
RJ01039895 Evil Recruit EN.rar
Size 540.1MB
Sample261107-qva1bact3s
SHA256 671618fbef43b2440501c34c6093f29af39b7350beadda147e144a05113dcb48
MD5 e26d5f0844a219255d8698a6ed8498d4
SHA1 7900a1695579c2c866cb674d0cdd71bb77370f93
SHA512 6e3809faf6706a45c3424583d3eccf16ff1f12e604bf24e04634be222e8b427f7a127c6f3b5441b7cd771cd8940691be1dd505d2e46a7fd745468b5c6b89aad2
SSDEEP 12582912:lbVzugUE6EL0yqoYCsBC0AQ0NkfJyEVjRmn88UGfGLfuJGYrK8:LzpeifYChX1kfJyEVjkjjAf2rT
TLSH
T1E6493389F3BBF4E836413D66F9643E08A6ADFE9C9407E48667274419CCED4748F8590C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  English/LICENSES.chromium.html
- Size 4.5MB
- SHA256 67885e1586ecf0354e79467340cebe4d977b8ddcb432f7e832008b4ff3c8a1ff
- MD5 c91c1d7d87f2ec9aec7efa9d34808000
- SHA1 5325eeb991fb27fcb8640ac3b272ab387a884eb4
- SHA512 6dc0e6518cc682e26572fcc4627ad2a5a616931b4f9fc328a12272876e9139ceefa8bb8164984de6f574e8d76952cf206c79f1af6c9e75eafd92a37619a9d735
- SSDEEP 24576:3sOBLmnLiLxsmrwrDK7qcj/kUg7wWnQJ8um:cGLmLAKUuObjhJ6
- TLSH
  T14A26D66BBF49037306F282626A4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  English/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
- MD5 fea40e5b591127ae3b065389d058a445
- SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
- SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
- SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
- TLSH
  T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  English/evil_recruit_1.exe
- Size 99.8MB
- SHA256 8c154e9bea754faad5e8557fbe10cfe38750d9f0a19ffd4f28c631defa114452
- MD5 90eb16bd6f887e301a95e27569b8a449
- SHA1 23fde8aff275f7e8622c0dd79053c332ed211cdf
- SHA512 3bc2152d75b36b25b2237f6a76d0b8795a0b09d57e117e49c2faef50293a0a68041d9aa7b3293fc3f5f6e97e9226870ec84ba86b096f010f310e5f017c83698b
- SSDEEP 1572864:V7DcMx/CTjnkIgPvx3b28aaUNyAlMjxcDoNc:V3B1xze
- TLSH
  T15A387C03E2A610EDC05DC2B49B1B9526EEB1F8450734B6EF26A457222F76FE45B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral4 behavioral5
- Target
  English/ffmpeg.dll
- Size 2.0MB
- SHA256 ab5ba5774f5aaabb21715a31396f5df3da1e71e91651b61a402e581b4cd0df10
- MD5 b4fe8978c43a979ab771edffaeb4772d
- SHA1 1c48ac0c90c0ca8f489466fd823d2d4cbc3c0930
- SHA512 9975d7efad5a1320beeeddcec32e01bcaed61bb74f0e9550fb42654b6d580c0fdfb9ef6663d9260c6b979936e4528842dd25e22399457db091b9384b9ebd6474
- SSDEEP 49152:E+cOvGFd/RIgWtRZgE3A0bsPSZAjhwFo7zMYq/X+838tUy1zr:EDOvkOjtRZgEwykU4r
- TLSH
  T14DA5BF07F6A601F9D01EC1B487AFA633F6757C494620763F2780A6252E7BFD08A5EB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  English/libEGL.dll
- Size 138KB
- SHA256 65497ba09e2be715c5413f8c0e05e3595e9c1e1e609090f979d564a949331413
- MD5 1f6f92a5282314ecb94dda50c0e02a3a
- SHA1 c95540bdb96a0add30550a9449a81a3a488cc7bb
- SHA512 93567daa02d8dbb7aaa58f3b13a80adccc88fb30db70d3aca28d29723e00dc7e88c60c285b114bdd55954d71ab671f4b00356fa1eed3ee310655d190c23ee776
- SSDEEP 3072:tu1goINM1Rn1Pd9rN+xrBXs0AZ8ia5od09YPgFS3u:tYB+iBD9R+780AZ+A7e
- TLSH
  T15BD35A2B73A2017BE8678235C9634A46D7B2B81117719BEF0764435A2F673D09E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  English/libGLESv2.dll
- Size 7.4MB
- SHA256 23138b8fa15820737bafe0864d8c775e529e7b61d4d1c5e7b5f783bbe7890ab8
- MD5 f58789084dcf160605f42018572d8637
- SHA1 efe501cee1785dd514f0195b9db45fbd7a0c5b50
- SHA512 e2608cda5745ab3cb76def98eee5d7f31103083a7aac44e819bbccb45f18c770a4116b93e1179f3cb877a7025247fac5a933846493b1de3287efe706849174fc
- SSDEEP 49152:z430yYnlr+59j2JzYP5YMVBtYKXUu+MHk5ktmveyBiXh3VfE4wfepY/23LdId74:z4xqm7YM/xweVPKi+EyJj/RrqGUG
- TLSH
  T119764A03F2A5C0A8D41DC278CF17D665E671BC859D61B29F3298732E3F72BA05B2A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  English/natives_blob.bin
- Size 80KB
- SHA256 02586eeaf4ce40d1b34310d885e34fb63e8e9f155fcedbd796536735907cbe80
- MD5 1582ffe1b8cb37438bc22edee6cd0a90
- SHA1 01af249f33b2e5ffba18ba8f7cd76f2ee0e5f425
- SHA512 8c66ba4ef15fea573c29f0f6977e290b8fd72f4c8833f31a9b0ef4285f5493e9b27daf3a02c352ed12eadce36cda933d9d97576bfa4dcbbcc04294e73ad9ebfc
- SSDEEP 1536:+bz4Oif2sMnL8gDpKD0rrr/4or06mGsY3csV3iEBSsU0fHBvJ4YfD3z5Q29ei7gy:+bz4Oif2sMaEBSJ0fHBvOYbj5heikwVJ
- TLSH
  T16E8366677FD67AB746A5B5F6E38F971EC2B8CD23663858B29408CC84199304C847EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  English/swiftshader/libEGL.dll
- Size 333KB
- SHA256 f76b789183b1a5461da03154fab67048865d27e2cc4ecd1014da33c912c60880
- MD5 f8bf64117e0b9bc056be8babc9651a8c
- SHA1 736ed899e4b2a4b555c8440b5be29c7f6c694e23
- SHA512 3b49dfa01485016c80e34296846272af2ae570ac5e5b21ffc5bbf926ea694d3f115b25ffd56c4b7bfaae25f7d7078c9b92b4205a9471a89757eceae1ac929f35
- SSDEEP 6144:wK2D69btDbN+DSNx/Ijuyb+s4y8JsAtrajfJAIfCt5swdDm:8c/+DFbFf8Jfsdrsy
- TLSH
  T14D746C5AB7A444B6E067D139C5A38A4AE7F27C000B71D78F23A4435E7F37BA1592E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  English/swiftshader/libGLESv2.dll
- Size 3.7MB
- SHA256 b84f8ff351c57ebf9cb55228a503ea9c0d097d80f4b29ab8cfba877adf2912f0
- MD5 823843dbc9eacb00242a9592bb2171d2
- SHA1 1515548bea2304556194d5d6646aebf391c94202
- SHA512 d727bde32eeb42f53c2a1e2a9929a76d19a22ddbe949e9d7da0374f141a9975e0aa1d5532297ff0e27967c82718d1ee1e8dfe6c522cde9a5740db2452dfae944
- SSDEEP 49152:a2f+5k/DO3kxF2tDqVJlNEcmJYL2ig2t+Jm3xPS2BA7/YwFidZ0HYukr7W9J6n94:dx/ekmnQ2Mt2+S2BA7/YwRtgUBT
- TLSH
  T13D06FA03D66F90EFE016EA35971BB322D1B578C574387576676639212BE27203B3B388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17