c58c99ee22d89012a2250d2716993180bd6d497f2d0d7a124b27de1873eae0b0

Sharing

Copy URL Twitter E-mail

General

Target
Sarv-0.2.0-rc.1-windows-x64-setup.exe
Size 21.0MB
Sample261113-vcvdfsys6n
SHA256 c58c99ee22d89012a2250d2716993180bd6d497f2d0d7a124b27de1873eae0b0
MD5 f2649df4e24dc7ec0ce61d675ff7dbf1
SHA1 e95ee4ac8e4194c4282e2cd9f1b7aac893af5e3b
SHA512 97ee8d462db1ce3371e71d6eedfb8b7b0312fb9718524c4c1afe8b05455fcd1336600b797985ffe4276757b86bacad43f9cb3816318b73add346ee36e1a1d10a
SSDEEP 393216:YzA4o9FLQXFSGkGRSCmDwI1kbS5ToltHTzSHeT+4MKdAMeaVPaCuxGTh48qsFAjI:YsrxsPxcjvm6clt0q+6d+OuxGFq7j33o
TLSH
T1CE273373F0E18C6BE172403B8A126FC1ECDF067EB2F04C17A6665A61EEA7953B355049
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Sarv-0.2.0-rc.1-windows-x64-setup.exe
- Size 21.0MB
- SHA256 c58c99ee22d89012a2250d2716993180bd6d497f2d0d7a124b27de1873eae0b0
- MD5 f2649df4e24dc7ec0ce61d675ff7dbf1
- SHA1 e95ee4ac8e4194c4282e2cd9f1b7aac893af5e3b
- SHA512 97ee8d462db1ce3371e71d6eedfb8b7b0312fb9718524c4c1afe8b05455fcd1336600b797985ffe4276757b86bacad43f9cb3816318b73add346ee36e1a1d10a
- SSDEEP 393216:YzA4o9FLQXFSGkGRSCmDwI1kbS5ToltHTzSHeT+4MKdAMeaVPaCuxGTh48qsFAjI:YsrxsPxcjvm6clt0q+6d+OuxGFq7j33o
- TLSH
  T1CE273373F0E18C6BE172403B8A126FC1ECDF067EB2F04C17A6665A61EEA7953B355049
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
- MD5 79c27de4d1c6d295fefaa70f608f1c67
- SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
- SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
- SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
- TLSH
  T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Sarv.exe
- Size 44.4MB
- SHA256 2d86220fa5aff50c08ce000e6fb414622d44ef2088ef9267de8e0c4051e0a0ab
- MD5 99bd202ad2cc6e7d78a11145168cd8c0
- SHA1 c706b75abdcdf28d20ce327bc0724e1d3a0d3090
- SHA512 d798fdaf393543af77a7d3bcc198e4fc4e11c329f7c04deaacdd3c60363cd033ae30b22096761d0e3b414b0d1976a91de253fdfb94b1a5b8d77916730afa6f16
- SSDEEP 393216:N3kQebWrbESiQ+n9/qYyfECATIZNYA819oY28:N3kQRXC/qYyfEhBqY28
- TLSH
  T1C4A76D93F11A088CC57BCA3B4376663AF6713A5A6630B7775E888F325F1ABC05B09714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7 behavioral8
- Target
  WebView2Loader.dll
- Size 157KB
- SHA256 86545b66cdb0603bc26b626fb9ad610cb6e71f28d468f5ea66df23b03dda96d5
- MD5 ff3ab627947e2c1c58f13694a8651c7f
- SHA1 280e4cb1c735b3ee7cfedc82a5bfe7c134a89d90
- SHA512 45a167e90716a08abf79f76fba42681cc8bc76f0087f62d028350c5d28e79b922dc1bc799b0dd0a086e7add20c17b9bd6a355674d7f1b0854f217432e4c7d555
- SSDEEP 3072:lKpb6T599mlMpgeMiqa5agdTl0RflJGhaTcZYEtJomT+JJg7yl:uGf9m9XkagdTlMvEtJKJg8
- TLSH
  T10BF35C57B3E510B7E07BC27485A34A42E772B81157609AEF0364467A1F23BD0EE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libbrotlicommon.dll
- Size 136KB
- SHA256 121006fe45e8bd12b1929f86e1efb1dbd1c6291118f9a409693ce8c030f1cefb
- MD5 df1e7a643471171cf948e4e90c3a5e0d
- SHA1 e6711b72dd05eb788385f8b0b0eac070835ad8f5
- SHA512 be94b1022928d8f916fc2b3b4b6becf64fc41efdce5d7256fc197ec592e67ceb519eb6260c01ab9e5828dc451ab274188f506fb31f65cc3550c3f745712969df
- SSDEEP 3072:OLUk4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBdFg:O4AhdNorGvHdbi09GJnFg
- TLSH
  T14AD36B61F3051736C26B627AE49A6BB8F375827493630521B4AD426D60C3CA4873F6FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  libbrotlidec.dll
- Size 58KB
- SHA256 dab7d47981ee887865d1f82dcbcc8fc4c7a43942278bb27877e168909e10d346
- MD5 f83f82b25bdd67ba3ae0499b6da6a2c3
- SHA1 db5703489e3e345d6c1ba5b82ae72848ace05e88
- SHA512 d6b4d18cfabe9d7be4e3e95a3f59824e804c37ad98a4f3fdb84425f188b80ee29581870fc084b139bc05bd915933825a98cd7a89a659071855de829d3aa94595
- SSDEEP 768:yOR3oQsdgYLb5LBLtLvXIL0LrVP4HbCtEyzk1059v6IfrX1szaoQazQxARbYs34c:F9oQsdgWR/VP5pz00HSqj1szao3OFQx
- TLSH
  T1DB434A12B3A3A8ADDF4781388BD39772F6397C482325EBB76184F5312E26D606F5C521
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libbz2-1.dll
- Size 106KB
- SHA256 a4fbb97c26662d2b8a80bf4597ed3effb69b12048b0cb1eef2c3f211e2e66673
- MD5 834cf6e7e36cd87412f8b32171baf61a
- SHA1 dc9316fe49df6c07fc5b31de1510185d4b2278d0
- SHA512 f27a54e0daefb14666eb658d226cdd0e41fbb2cd45d53c1d54b29392819d13669e71ffc81fae76371e5b7b764c0b956b0400289a87e45e64bafb5713754b0039
- SSDEEP 3072:kuJFnd2Q5f90UAP7mcv4jePfOvAT5oBJ9F3o:kuJFndr1aUMNa9F3o
- TLSH
  T14AB35B19F0E329ECD60381304A974F7AFA71BC590A20AF7BE560D6396D37F501E29E25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libcairo-2.dll
- Size 1.2MB
- SHA256 aa794d8f62e122d7739523643e293d26e05f2c1c723035079ba01dcaeda0dad6
- MD5 6869de417bf373e96b5868a50cdc29c3
- SHA1 9a965bc39de24645a6c643c2d09079717faa4624
- SHA512 fedbe60dbac7ad18daafb9c1f870ffe1f09582c1d5c1c2d9de791378d2d5d7591b2f0e28d652549b9c7a2ce010f09ab0f2af88116e8b38efa64fd83cf3e8977c
- SSDEEP 24576:zHj5nUiSDx7/jO44iUbBZ0XFx7DfM6H6NF4PJsc8o34VUNfRoGkQYoOYmoL0:npUtjjh4iUMFdf+FsJsO3iUNfRoJ1YmJ
- TLSH
  T1B0454A57E2A364ECC56BE034D227AB72F531B4151038AD7F5698CF302E22E60665FB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  libcairo-gobject-2.dll
- Size 30KB
- SHA256 2fbc11e9949328df850a5803162a8d812133208a3ad091630e6cb339b081cddb
- MD5 16f0a2be302cf2cd9d835b1a49d19470
- SHA1 86e3eeeefdd8f34d41b7a7edca543b254657d2ee
- SHA512 5f8ab4e8787662a2078611039c6b4b3666834fffc37c75d2ae6266317134d0b2d2eadd4870ee51ff2f2249a5e4ae8677b8ee4d67c374de511cfc9adffe1cefbd
- SSDEEP 768:jjd/xaR+xeymzNGBWRRRRRRRRRRRRRRRRROkZ2aFShp:jjdVFG8Gap
- TLSH
  T13AE2E706D2CBFC96E599837F44A56731F0F6B5402670B33F4262CAB16876F2A46BC163
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libdatrie-1.dll
- Size 34KB
- SHA256 2f784872e6404e57847201fe1e7e591bd5b5be4a319ef38ebcb36014ac7f385d
- MD5 bf99cceaa1db1d93757a67baa20fd621
- SHA1 98970e0bfa6aae2ec52c5fa3ba7a197b24b6e9b8
- SHA512 b576b2a22ab2701bf7efe71073b4c9855533dabe6ef23bfa53bb9031986751357c473b063de3960721dcb372e54c3a9069a3266737b0f9f0aab474e7e7711d76
- SSDEEP 768:+6U/zPUdaKukx/Lrcr517mFaySA0f04K/ehao3x:rU/DgaKuUm6z4KGso3x
- TLSH
  T15FF2F92B72D768BECA5BD27480AAD731F870F8112732AD7F0718CB306E75D914A2D856
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  libexpat-1.dll
- Size 231KB
- SHA256 d96eafff7e3356e13aab6b569cc373ef61b1b2b9489803f45561cbfeaf70ee1b
- MD5 f9f4d4da778068bb743c7085409a151c
- SHA1 204ba199add71d0f100cf9b627507c32765730f7
- SHA512 ad26e9a4c9a9bbb56b4823386a7be3477625cae9f90b1d6fd89161cc66339aeb4bc61777aa95881bf7d776e6db8339f9f13cc8896dfa30c954b74fcefd4e0682
- SSDEEP 3072:srnyslX1N7Mubsn3OORX/2y5GvwZIZUXYbBZKoLdG89ePfOtDWgIPoxErwHF3V8:9s1zMugneoX/EBBBZKoLdKOx7F3V8
- TLSH
  T1C1345C6BF193D4ECC19BD0748397ABB2FA33BC341220BD771590EA396E63E502529725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  libffi-8.dll
- Size 38KB
- SHA256 b649c515907436a3299326f83aea0e8d75c61853eb1609602603bbcb9b00b4db
- MD5 82df84458ed90aa710d29cdcb9ee32b1
- SHA1 b4505730cc945cfdb0b4585e2c083fcdc0ef4309
- SHA512 413f8c3debf768c499c2541d47e5876a4be2823d7ed3eea3b1901e2def59197b60d5194831ad87cf5b4ed11df19705136e418acfecc96de672299e8dd94a8035
- SSDEEP 768:IxqJQgp7VFldTswKTAkZ6Mh8+Of0i2146oi9eMNsAbBcR:I6VFfmsMSB640eMaASR
- TLSH
  T179034A2BB2D294BCDA93D13095A79BB2F032F8110322BFFF45D8E6722D14D94572CA56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  libfontconfig-1.dll
- Size 496KB
- SHA256 bed1827dbb226483026b2b33127866ce173aa2423d89ae7da6f88d6328792ec9
- MD5 8608d81113c3249946ea763f284eca92
- SHA1 474a2e54934015992af0261cb82faaf9313f3b0d
- SHA512 a956a89e1128c04df60915d9a6c0475702b924e476124c2d7d5d967c02a31415db4dbe8b6d2938b8c6ab6891665adb00073aab9a7dc9508ec6c1d4c6a22cfa45
- SSDEEP 6144:511hGm7ebM5Zh3m9PpfipHxE35HTQ/1As38WmUNfDjpR2mBo8JT:33+MzhW9Pr5u5Pf2mBo8JT
- TLSH
  T120B40517F282D2A8C51B81354E96D6FDB570BC11CE21BD2B72D0F73F2E71A504B2AA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  libfreetype-6.dll
- Size 788KB
- SHA256 9f62ad75bdc24573940f2e0b0db1848464ce02928926808885e3744fc5272add
- MD5 8fd17e8c5611f428edad124ba3f13f3e
- SHA1 9bb54496aecf06e8f88cbf591781b2548c06c9b5
- SHA512 5e6b4232e549b739231edfc6f26cea1d975db44a3e972cf475da61ffa114c92d3236791b10e3334400cd9475db07876f4376488e0a120613b14196d52b830b18
- SSDEEP 12288:X5C4ys3JMBiAjWdMnVaHAWfLT6nm3iSXPy3Srk5VmOknaRCWE7FPWSfEWmhPuf97:X5CVkMY8GQaHAeT6nn1R/RCEZhPuf9FV
- TLSH
  T1BD054B93E3A760FDC66BC23442679772F931B8141134AEBF91A0CB313E61E60675DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  libfribidi-0.dll
- Size 150KB
- SHA256 777543504df2de352659d5153f90c9ca17957d9ad88fe8d37126819995f5336b
- MD5 54c3c78fd848c2912bd9a68c645b56d8
- SHA1 4563733fe253a727a53200e9a8e8a2c8b70dc073
- SHA512 41c99605c376c774aee78f0b4cababfbbb45695f1f7358ba2c420fbc6af7c2123fd363d991ae5363098569a1f5d8d33afb202fab68298915a0e11c96623f04ff
- SSDEEP 1536:QCvfamMdh81F8M1sUXTePfOe0RcQQIrIzbpqO000jfe8lFd:78hgF8r+ePfOe0WmI4O000jvFd
- TLSH
  T1D1E3C407B6835EA9C7D292344892CFB4AC21BCFE1713583A2A78D23EFD749E356049D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  libgcc_s_seh-1.dll
- Size 145KB
- SHA256 661f70dc19fde8c25bb56387b807b7a9ab7e532cf58fa8aeee078256c19d8980
- MD5 358372ca95fa793727b8f5d342d976be
- SHA1 2f29593d36697564c2cbc204ec072eb8695d25cb
- SHA512 82d84de7ded3e7c6bbcd03dce923c87eb714d51ef2b57c85864e30f39c768e5c9ba27254f4cd7dacbf0c7c6ee128081a5a939c03e7b2c57bc0169d56da272a1f
- SSDEEP 3072:l7RIBq44t9pjU8E3qYuIrSl2vYAh2xDhWWFFa:h9UW9epU1HFFa
- TLSH
  T107E31852F19371F8C697E2309A939FB5E833BC740230A8772399FA342CB1F815A5D652
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Network Share Discovery

Checks computer location settings

Checks whether UAC is enabled

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32