597955f9905c34b066ca61a747e1642afd8ffd099a96565f59c7c1d574e79945

Sharing

Copy URL Twitter E-mail

General

Target
myfiles-setup-0.2.3-amd64.exe
Size 4.7MB
Sample261113-ff2jlsgs5k
SHA256 597955f9905c34b066ca61a747e1642afd8ffd099a96565f59c7c1d574e79945
MD5 6e7c49a8da319280cfe8d115e08b33db
SHA1 ace3d83475144b61e6bab58d42bca59349c0661f
SHA512 2a1c86ac06e1bda5ca598dcecd37a3a82f326e1ee5041e5cdfcdc0a03f26ec71321afad0adfcba4a90b0e346df9b063eeb30a7fd7969782d866da8ea048ee7a7
SSDEEP 98304:I4S4RsmfbSGD+JD1n85eUMCV+vY+iugwRNzJUgU:I4TOTD1UeUMCV+HgwRNzJUgU
TLSH
T18F363304F04A80FFDC6466F26E6A57BD226094B72EB84FF992CD35792D106029E3F4B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  myfiles-setup-0.2.3-amd64.exe
- Size 4.7MB
- SHA256 597955f9905c34b066ca61a747e1642afd8ffd099a96565f59c7c1d574e79945
- MD5 6e7c49a8da319280cfe8d115e08b33db
- SHA1 ace3d83475144b61e6bab58d42bca59349c0661f
- SHA512 2a1c86ac06e1bda5ca598dcecd37a3a82f326e1ee5041e5cdfcdc0a03f26ec71321afad0adfcba4a90b0e346df9b063eeb30a7fd7969782d866da8ea048ee7a7
- SSDEEP 98304:I4S4RsmfbSGD+JD1n85eUMCV+vY+iugwRNzJUgU:I4TOTD1UeUMCV+HgwRNzJUgU
- TLSH
  T18F363304F04A80FFDC6466F26E6A57BD226094B72EB84FF992CD35792D106029E3F4B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
- MD5 79c27de4d1c6d295fefaa70f608f1c67
- SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
- SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
- SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
- TLSH
  T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
- MD5 879b0aab93b11228a27d6b2e498b95be
- SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
- SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
- SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
- TLSH
  T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  MyFiles.exe
- Size 14.4MB
- SHA256 f01734a14d8c48adae8b68c19da7f0c68390453a02d55159c0e82030f685aca5
- MD5 fe6ab075768243a956b6f8325fd7566a
- SHA1 301433e5aff97dbc89aff85b61fb3fcc3d3602ca
- SHA512 f86d739662f4c8e5f92dbdc5ade7a7c95cc3a1f0651f3cedbc526c8c0d9f266ee55bb6ed467fda20197c3de101be54c74c4f82d3b9fbd6222d178d6d632f83f3
- SSDEEP 98304:JOqA3DDZrcXks3vXkM8zKOj92SfFQtEN9AQV4DmA9bc4FvMfP1tzwvES:HOH9cUsvFhlETjV4D1I4FvMn1tzws
- TLSH
  T181E65A47ECA901E8C0EDD131C5A66113BB717C494B6163D71BA4F6286F77BC0AEBA318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9