8879d9ed1a55fe248773b9ff07303977702c908625e2fe63a6df638ac605a943

Sharing

Copy URL Twitter E-mail

General

Target
U-King-Setup.exe
Size 4.9MB
Sample261113-jrhsesht2x
SHA256 8879d9ed1a55fe248773b9ff07303977702c908625e2fe63a6df638ac605a943
MD5 a97251478683a3a96db665acdc8ba6b5
SHA1 6e5ca4a95e77196a897a284e235a059239c1e973
SHA512 aeaf6afeab6b37103903f31e69115c4e26c0ed072829379a7d215c38487737b6cd115157f1ef68fda0c846008ba7e2d7f1305db7f7b91026d5a75e50ec40a341
SSDEEP 98304:WARhpPeWMCsdC9IwQRcunCEMbRsHxS1ua7EvTe2:WARhxe9CsdWkRxnLMbRsE1uxTe2
TLSH
T148363335695DC4BBD818AAFF00B2873ACD15E156622ABF536F817882FC1C708D653B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  U-King-Setup.exe
- Size 4.9MB
- SHA256 8879d9ed1a55fe248773b9ff07303977702c908625e2fe63a6df638ac605a943
- MD5 a97251478683a3a96db665acdc8ba6b5
- SHA1 6e5ca4a95e77196a897a284e235a059239c1e973
- SHA512 aeaf6afeab6b37103903f31e69115c4e26c0ed072829379a7d215c38487737b6cd115157f1ef68fda0c846008ba7e2d7f1305db7f7b91026d5a75e50ec40a341
- SSDEEP 98304:WARhpPeWMCsdC9IwQRcunCEMbRsHxS1ua7EvTe2:WARhxe9CsdWkRxnLMbRsE1uxTe2
- TLSH
  T148363335695DC4BBD818AAFF00B2873ACD15E156622ABF536F817882FC1C708D653B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  skills/install-windows.json
- Size 71KB
- SHA256 10c0f8aff5ba9ccc5e7f9aa7524f945f1355220f9b9565d08cbf2a4f5dac0362
- MD5 76523f0b6ab8ca188c9ce34925ce73fc
- SHA1 d17e63134c742121e121c6519e0a4b92fdd0f7bb
- SHA512 1804f544d8442ff0e7ad3b8d4cd7499e03e323eb925b25373bfaf6d57a5977c71838b9b9b4bb1985fa1aecacb4667cd1c1d2e9f2ac030811bee6e8a47a5dfbc7
- SSDEEP 768:4GQicbHVssG3LaSFNsKvAgNeJxAv4fVDVRNfgc/7w39QVnS3Db99Db9B1MmZ:TglG/NsKvAgNouv8KcDwa9STb9Fb95
- TLSH
  T1F4730773C16DDEFB06F417E4B6895256F20A031F01C5B543F6BC792C6FBA0660A89A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  skills/officeread/scripts/read-doc.py
- Size 8KB
- SHA256 9e0410be1aaaf583d292ef9807b2205a86355e3c824e7b986647ab5d73929144
- MD5 71377bf66299d6859084d44da0507026
- SHA1 492107661d6882989cf9a2e57ef665012fe631f7
- SHA512 3af2bcc0ae9a2548446c7164d1682f52afb23b64763ac21bae7254bc819a2cfea980c741adca115ac05b988f462b0511e8135d037a00d37aaace7d5664805e32
- SSDEEP 192:d5WqVBLIP8V8cELrZSe1+cCzPQCbpc4EY0bEMeyA:d5W4pIPkrWZx+HrQ2QYmw
- TLSH
  T1F102089590581ED29BE78D381A4AD120A321FB0305B755F4FCCE534C3FA89395278BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  skills/vision/bench/gen-fixtures.mjs
- Size 8KB
- SHA256 88a9c9d9ce591d98a13bef8c20fa1a37eeb342f7d34939da02fb0119a97d1ead
- MD5 467bf00b655391e581e88448164a5257
- SHA1 4ff134a86913441168e6fd91f3754559b13779cc
- SHA512 d43ecde280d01039e175208e3b47c3d8ae7d35b4abe1fa7e676213fcc93c0885953b882535308e024262aa709fc615bea52a8e45c11cce3e9e77e8dbe53aa9aa
- SSDEEP 96:+CRBC0L41Xx2lcePYa3addzGddrPJ0rddVZ1dtbE62Dzx3vb7cW5wpdy7xS+6NSO:+CRj4tZy8Z1dJE6U1vOpwMT4V7dGj0s
- TLSH
  T185027562D2D43824607685D4F511AAAFFD809643A3478F10BBAD2E77FFE20725A532CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20 behavioral21 behavioral22
- Target
  skills/vision/scripts/read-pdf.py
- Size 10KB
- SHA256 c541cb09655a2f8b5de3a6755c3335ce35a41adbc6bb848519679813a9c1815e
- MD5 64ff14ba5f5024e82a54eb65fca31bbd
- SHA1 b2ccf89ff4f97ebdecfff24a633e73eb41a499ee
- SHA512 d3b9908f2bdfc1b8cc9b3f195ddf8ae7095ca008cb04c265504a0ddaa31ca5d2b8d2edbbcc33d11eb7851ee811cd04dbb8415f72fcb81518fe5739b5982afc5c
- SSDEEP 192:rzjgP7InkcfU9wCOtaIkY6KTzTKX/xRN0uSQypjDqZo8M5Oz0mMzi:rngP7InNptJvZTzTKX/aueqZOy7
- TLSH
  T15F32F949D8242DB1D79BD029AE9688553279BF07A4101935FBCDD4883FC903583B2FFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral23 behavioral24 behavioral25 behavioral26
- Target
  skills/wechatmp/scripts/render-mp.mjs
- Size 1KB
- SHA256 2ce8addca52c38d08f9087ad89c6bfde92f59e90ce094555b095f626ae11f781
- MD5 ccfc6970371f22f8c298067feb5a18d6
- SHA1 fa843cce74a1765bfef72f2d2875eea544330b6d
- SHA512 a5718a6263e7286db17c177e72dcbca5580e2947084da5164279fe342f676d0f3ca434bbe6c00fc074eff9cb9a1e62d7a4ae725f51e29dd23d77ae4c33c36519
- TLSH
  T1232195129AEF593E1B581ED1A2C5800BEA9FA990239CC9D4F3AC48BD7B5A14080C47FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  u-king-mini.exe
- Size 12.5MB
- SHA256 d3c7ba4860c74001a198e7bdc318d56ee9f6a26154fbce6ffaf4eca0428789c5
- MD5 988424aa11f32a0a1309abdfb57ca438
- SHA1 afbbb2b01dabd1af3b48590d20d23b228c8a59c7
- SHA512 067fbf0116715a57ef32b19e409c3d388c29b46aaf57306bd13e142064370a348ae9ffc0493eddb2258cd058e86dfb323298bc281541aa47164ff622bd01a85a
- SSDEEP 98304:GKWb3/XoCXt8B865HRQjXW4tAEmn97Soq14Hsc2DlgaN970HZfC/t+ag57wXeHEH:ZPCOfuh0HZKVspwO0zHGalV
- TLSH
  T1A9D67D07F29181E9C0ADC178831BA637EB71B88D4535B29F6BE84B112F2AF506F1D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution stealer trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral31 behavioral32