d50b0136be801b504dde915a65b9682bc81352530bcfef4804291591079f54d5

Sharing

Copy URL Twitter E-mail

General

Target
myfiles-setup-0.2.2-amd64.exe
Size 4.7MB
Sample261113-ff33fags5l
SHA256 d50b0136be801b504dde915a65b9682bc81352530bcfef4804291591079f54d5
MD5 6d677d045937a23d8aac2138f0ee7791
SHA1 26e0f80c345111abcd6473e46b4872e910c5ba8f
SHA512 5bd9c641e68bd2b12f5de7b7132d148da47f2f443b38f214c8509b66d8e47aa98fc82777cf5c9ab20a6b814e1f3b71e1c861189502220d8a9602fe9a8699f3d8
SSDEEP 98304:I+RpKmLFErxEvpPDou+DBWRIiErv1IuZNpB9x7KLn/+RK+suQhV3Iz4:I+jKeEre9cDDBw2rv1Iu/96/+RdEV3b
TLSH
T1043633E6EB70EE3FF0D66BB23E2E4B12BEE4E558034302673235A551766234B9416D70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  myfiles-setup-0.2.2-amd64.exe
- Size 4.7MB
- SHA256 d50b0136be801b504dde915a65b9682bc81352530bcfef4804291591079f54d5
- MD5 6d677d045937a23d8aac2138f0ee7791
- SHA1 26e0f80c345111abcd6473e46b4872e910c5ba8f
- SHA512 5bd9c641e68bd2b12f5de7b7132d148da47f2f443b38f214c8509b66d8e47aa98fc82777cf5c9ab20a6b814e1f3b71e1c861189502220d8a9602fe9a8699f3d8
- SSDEEP 98304:I+RpKmLFErxEvpPDou+DBWRIiErv1IuZNpB9x7KLn/+RK+suQhV3Iz4:I+jKeEre9cDDBw2rv1Iu/96/+RdEV3b
- TLSH
  T1043633E6EB70EE3FF0D66BB23E2E4B12BEE4E558034302673235A551766234B9416D70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
- MD5 79c27de4d1c6d295fefaa70f608f1c67
- SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
- SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
- SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
- TLSH
  T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
- MD5 879b0aab93b11228a27d6b2e498b95be
- SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
- SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
- SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
- TLSH
  T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  MyFiles.exe
- Size 14.3MB
- SHA256 809c320604bfa6ff9c05ff14ae5510a4d6d0041d722e63f8823f75f303e23009
- MD5 9f0f2625fa78260da1fd280c0280314f
- SHA1 79f18bde43b1e10e33b322b6d9ea961a90ac65a6
- SHA512 307a2b02bd9e264accb7947e13a5059c34269808467743ec9d0fa1ea6782802302db0183a91f0633e0945c12f82edecfe9d5629322ee28424e6b49cc41f30282
- SSDEEP 98304:oRmTZLNyrlvyd9pkOL9M/Bg17N7rIpDPI0lAOefDCMHIxWy6aEE:C49IlqdlqmwP6OGDs39
- TLSH
  T126E64A47EDA916E8C1ADD630C5E65113BB317C894B6463D71BA0F2242F777C0AEBA708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9