850f4eddcb99414da70a7d9de279078046c1c4426d40b983ae517b9e945843a1

Sharing

Copy URL Twitter E-mail

General

Target
CaptureGem-2.14.15-Windows-Setup.exe
Size 195.4MB
Sample261113-hmwcaagy3z
SHA256 850f4eddcb99414da70a7d9de279078046c1c4426d40b983ae517b9e945843a1
MD5 421949d6b9b9aa92608449376ea1f901
SHA1 cc338e211e3c99f8e4f9ba2610abe6d64cbc07fa
SHA512 1d1099b511c82d00ab9dfb3892c890bfd9b716d129265bce091109c95867199ede64e32f47a21cb6bca0d7cf5b692f91ebf4fd7f46dba0619c5cace890003903
SSDEEP 3145728:MzA9k1hjWY/k0tFPvSwDwmFgMSj4LeItPL6+EOLSmQVc9Ft9O7OvTZe5G+9B89U6:Wv1NbuwDwmDe+PexObZt9R9s7bW
TLSH
T13BA833287746A972F5C88F7D27077A70A5BFAE045D94E39731A394A86F4B00053C4BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CaptureGem-2.14.15-Windows-Setup.exe
- Size 195.4MB
- SHA256 850f4eddcb99414da70a7d9de279078046c1c4426d40b983ae517b9e945843a1
- MD5 421949d6b9b9aa92608449376ea1f901
- SHA1 cc338e211e3c99f8e4f9ba2610abe6d64cbc07fa
- SHA512 1d1099b511c82d00ab9dfb3892c890bfd9b716d129265bce091109c95867199ede64e32f47a21cb6bca0d7cf5b692f91ebf4fd7f46dba0619c5cace890003903
- SSDEEP 3145728:MzA9k1hjWY/k0tFPvSwDwmFgMSj4LeItPL6+EOLSmQVc9Ft9O7OvTZe5G+9B89U6:Wv1NbuwDwmDe+PexObZt9R9s7bW
- TLSH
  T13BA833287746A972F5C88F7D27077A70A5BFAE045D94E39731A394A86F4B00053C4BEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution pyinstaller
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  CaptureGem.exe
- Size 154.6MB
- SHA256 d69a9efd1579a7b8743d1c70bb306c081c1b19c207a9ca9bac04aad9a11b697e
- MD5 298fd096ed2b2113c2fc84783c371d17
- SHA1 b93aa97fd77ed561253be4a51d10c117a82bb650
- SHA512 12b7ef445e60a36102b0e404cc9629567f96155941f914b03f7439afdd5a0e0a62c5d433a4ccf8aee44569feb91d9b2424993d7253cc4d634c675dc2361dc6ec
- SSDEEP 1572864:+QLTsMunuCM2/w9Asn6xzIEhw3JvqzPd24cwT3tIDvvEO/TZidNoyiMhOab0XLHE:OA8g5vu
- TLSH
  T1A0788C03E29A10D9E05DD1B58B579633EE72BC864734B2DF265427562F7BEE02B38B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 6.4MB
- SHA256 57b8e5a3f2cd62805001aefca035c7348b4d1abac157e6df3d798bb31f2ec3d2
- MD5 c3528648bedbde1223a2faab1a3f9af3
- SHA1 934d3c8f184258338ff380964ed89053ce69ac5b
- SHA512 3e3cc0fd7a55f67ee0afff9696beef33bdc9524375bbe9d8e8f7660fd408c756c1156ca0b02ecccdc22799c7b8e74dbde012732ad6b3ebe0a3cfc54ff5132b35
- SSDEEP 24576:d7t05kvWS99LVoFIUmf2p6y6E6c666r8HHdE/pG6:RI8j
- TLSH
  T11F66942F7B48037306C602A2AB8BA5CBF21B903F3B565654345CD1681F6BE2543FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  bin/7za.dll
- Size 406KB
- SHA256 af80aa034718b11cbd1edd10bbeebdf5e63cdf31ca7ea3dfd33ea053e4693c45
- MD5 9a9fa9bc21d5ab99e81b5c7089fb63b2
- SHA1 aba03c58e7cee546b448e62af31e87e13eef7a91
- SHA512 65219cb75bae7e4599c0ccd16cbf2b822fa1818bab319c7076921c418db99e1f604d5023cc14088f3e75acf68660f7568c4da337b02311423582a7c2c0c8ba4c
- SSDEEP 6144:vwQMBL1ut5MjUebUVRuK6IKQfkXesBBhu2mzth06P5WvzmgRc:YQMBk5MjpbERu9xQcXNQv5wzmX
- TLSH
  T13B944AA6F6788571D0B7D079C9E25B96EA723088173097CB12948B792F17FF94A3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/7za.exe
- Size 1.3MB
- SHA256 574bb90d17732f3cc4145fd4ba12d8f29b9d63400881c0e6fe3110c88b0485de
- MD5 cfd95b9816f15eb24c5721814561ceb0
- SHA1 b5ea2973090649b06be497bf8ba0606d37e1738a
- SHA512 449f58426487f391bc2aad6097b1594715086cea1421369b6fb3a73e3339b03aa9571fc42871a9e68c7594640af0be6ab15201596f21ee6ca2d57bde72fdc793
- SSDEEP 24576:fflhaJP/Hp18iHvgtFhRhABfzXRZ3bBWI7Lf:fraJ3HpaiHE0f3b
- TLSH
  T110551A66F9748275D0B3C0BAC6D29B9AEE713085173096C74289C76C3F17BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/7zxa.dll
- Size 212KB
- SHA256 ac5a507af6aa9bde3c7580ad2834fef9aadd0170648d04fe85d38bcf49a67093
- MD5 bcbf0e9e2406df94ae5f4ddcf9feafd1
- SHA1 764e2876ff985181a408d51cf5c180bbf9ddd1a6
- SHA512 b8eb03ab6ccf7c9d8e893e9ed8c92f8792d0cc9f603b3f755b705d45f11c2c315073a49b818479dc66a52ac09f0173655810547e08afd6d7b9cdfea7d4f74656
- SSDEEP 3072:Ogl7NhPmu1cwGRhNM2lFxRv7lUHSaRPQjNCRP5ItSBvAGTSkjaRvhPq1S6BPA2BF:OgXhu4cFRM2lsI5x2HX0IN2Z3z
- TLSH
  T1A6243BA6F2B485B0E4ABD079CAD65B82EB717045477097CB1250873E2F27EE95E3D320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bin/curl.exe
- Size 3.8MB
- SHA256 b3eefdc2420dd4e91c87dbd20682a29c64bf6fd8e5504eab3ab3c76a8a131ca0
- MD5 2f5dd7b6e09a514f0b13a78b1b0ad191
- SHA1 3d0a459fe028a6b16c6a70fd0ac21045a1cfd0df
- SHA512 8c61b37cfec447e19557d943b71a668d6d990512e64df33683044075ac3f610d0237673a5e82e164375892697ec6b770c01e54b0557bbd9c972475bb60b67cf5
- SSDEEP 98304:1fmW2rGyHozvTl9XvJG58FLYN8zxCPiQDt:fJ5N6ht
- TLSH
  T137069D67B5A061F8C411C074AB4692369A71B8893F34B9EF11D88BB03F96DF12F3DA54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bin/ffmpeg.exe
- Size 157.5MB
- SHA256 513368c81583572ce1d09d5c7ff827feed1a63db352412a5001f4da3a1583d98
- MD5 bee668680f667b59f5a8854e6021ff0b
- SHA1 b787d4d87e80f708014734724e64624a04439d9f
- SHA512 c536c73213a01fef82d077f4ad98c59df7353bbbc3c170bf52831156334ef465e13fa1053ac024142073744b4af5200ff76b95d3f9076b962ce5e5ec9c7a8a68
- SSDEEP 1572864:qUlo8PEEEG72yKx2lfVNmZDwSeYuK8CLEfVadawdcYS/aEHBt6w5Hnflkg+rkVR7:AG72yY2lUU308w
- TLSH
  T103787C8BF1E350ACD52BC4B0436AA732BA34785D01246E7B67D9DB302E62FC05B1AF55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bin/ffprobe.exe
- Size 157.3MB
- SHA256 0fd8f3bae96cc707993bcd8c56c13f8cd73962d37dbcaac0dad4fe3a0ce1f68f
- MD5 3a880e0fbf8dc31a0be98d4c39cf60f0
- SHA1 99c3d408254976b8f53a0b97467a80080aab8bcf
- SHA512 18322979d7bfaa08db65e3dedf41598304caf9ca5da61e4fc26a432149244740d49b36fc265e56c78ae3ba932aac3caab29dbabdea683c1607f3315662d618be
- SSDEEP 1572864:ou68LFF9YzLC0/W1ONSziUj+CajyAGvhGrwdcYS/aEHBt6w5Hnflkg+rkVRJsZR1:vYz+0/KCVg
- TLSH
  T13D787C8BF1E350ACC52BC4B0436AA732BA34785D01246E7B67D9DB302E62FC05B5AF55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bin/libcurl-x64.dll
- Size 3.5MB
- SHA256 ed9efb9e88a76ce333a334ce11ba1ce49330db3be240d84de11ef09c342acaca
- MD5 1fcf62edf11d67cf59562d18b2117895
- SHA1 41a0e17663914f609ccb7e4b11c00c78934cb583
- SHA512 91718c2f6f46d9bed0b233e366a6efe9a9b53cf930017cee67d7d15fbfa9c714385408d2943c5700adc39613ac7df7f0d47be8e52137cd98dbfed14d798829c7
- SSDEEP 49152:a9d2xe8tQC9CxQ7QfwUbg1w6welRBsE92L71Vycdx4X4d711/XQrzmv30iYvuzs/:jfQqCu8o1DlReg+XszmciBsVzjkZ+
- TLSH
  T145069D67B49061B8C454C034AB4B97279A72B4C93F34B9EF11D88BA43F95FE12B3C658
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bin/recorderd.exe
- Size 19.4MB
- SHA256 e90514ea98912e86d4f6fe78e1ab8248bc48de61f198e144b02ff40148e7d294
- MD5 747fd25641aaf85164990ee892563344
- SHA1 745fedc539ccc5d958d21a64d320823654503afb
- SHA512 9e74c2d883a9f3af29212b81d2b34a2cb877f9be8ae03f6f87f90120320233b691481df1564dd57e774254041c290ed2b45af8fea7342edd075950f3cba22016
- SSDEEP 196608:JmvM04Lp+GfdRvRKgBfrqOyksqMamDp4e7nYqAC7M5dUB8UmEyk2s44:JX04LphdRDhrq3amDj1Ur8mEt4
- TLSH
  T18E276B43E86545E9C099D235CAA6A213BB717C484B3233D32FA0F6746F76BD06EB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bin/streamlink.exe
- Size 26.6MB
- SHA256 6eb42ea80d8528861c6dd4109e9c9533029cdbf9c6a12fde904be950ffb87fd5
- MD5 177576fb37233cf1fe77aa42fcbdf021
- SHA1 d95a66df108304237243e258660347faa9d45861
- SHA512 57537e7dc85478650550d1e41f6f3a8df0a6cac853e775e9d42d875c9f3a2f0b489ee5be493c238c85812dfd2e63d38336da0c389037f972eef63b98f2611cad
- SSDEEP 786432:lcqLCsNm0NQJ0ppgg0LhXBejaxLXOU64K:3C05SJRLlYjiHFK
- TLSH
  T16C57334DC2EA09D9FDA66B3A9A63B720E3B67D400311D9CB06E19D91AF531E40D35F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Discovers running processes

Checks computer location settings

Discovers running processes

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32