2820bb9892c19ab3ca720d3abe2a908e6848f57513c2f7bd4fcd74d759469242

Sharing

Copy URL Twitter E-mail

General

Target
Nudge-1.0.0.zip
Size 322KB
Sample261113-wezxdset7w
SHA256 2820bb9892c19ab3ca720d3abe2a908e6848f57513c2f7bd4fcd74d759469242
MD5 82c935348cf24a8f1ca69544b1374d0f
SHA1 39ee9ffd97172c60bfd24809a0500f7b00a3e2be
SHA512 c28f0d1c676b0775997c9308a74e7394d8f5fa3401ca9984db28db31d2081899b90c399c43c6e3d668a470197d6cc73c650b1613da3ba17b4cefea8297aa14af
SSDEEP 6144:5KiME58LJ4dA3H/RI1HLB2eEfJyCKo3jpF9MGKZctLAA21wdY/kkmb:5AwwX+1HLvExyCRjpwGKZctLA+kmb
TLSH
T1AC64233D542D3E96F11A2039F5791EA6C12F060C9DBEDB3602A6ACF99CABF64031D11D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Nudge\install.cmd
- Size 208B
- SHA256 ea5c7c8f12429a6cb8b4b57ac2f1460754e502e418e975bd5d70ace8a1af800b
- MD5 6ba0d4e294b7b5a2dc24567314e45dc0
- SHA1 62693a8abb32e7b37c8a01f8946b1db811f0402b
- SHA512 c6e6e3886846fe415c25f55aa9c9ac61d53e81e64ac44684f5528d945ef232155e3dc9a6194dd26a27ad36762e779a879f5eff9a5a3d0ab99120e9cf5d303fb1
- TLSH
  T1C4D023253030174435F78C517A76E158EC5D10DBA7454D52F17341352E4E360D39D0C9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  Nudge\lib\Microsoft.Web.WebView2.Core.dll
- Size 681KB
- SHA256 d60e6e94245078cb56e44ebd5f360dc04bf18e460136be93bfc4cfca43b98505
- MD5 e336cd4cc1f67e3f57ead4e72a24c93b
- SHA1 c03565235315e597786b287b52e00f27bf0de806
- SHA512 950516cb1f7a493592c0ad4c39c0df9a5c0cd44225cff17e2561d72d908c4f7b8623ef28610c66c6cd0b963ac89fcae9ab41a9a99b42249114963f7e21e92bb2
- SSDEEP 12288:RJ4dCXzRKX4EcJupbSRi461R1VFrP3224c+iKmDRkRFNBMUFeA+imQ269pRFZNIz:RJ4dCXzRKX4EcJAD1RnQk
- TLSH
  T14DE4301223FD8619F5F27FB9997412609BB6BC97BD78C38D0698642D0D72B819DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Nudge\lib\Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 6a9e6856f23c463783c3afb0ca5d78f56324c86657162ccb16d5227b3233b32a
- MD5 f1a15a22fe0874e4bb2e8f05dfd62f57
- SHA1 aa06e407c7b4241ae559aee616ef156540a76a12
- SHA512 5c467d9f6d27b12931777520e10c85599742f9fa9a9add3971be9a862bfa278c526310368e8a8d79d39673c2af5c1fa3daca0829127b755728596770fe460198
- SSDEEP 768:psQNb2vIYymJ22Mss+5JQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxx:pzb2vLbJQ+ZDgcEST3p4JjrjaeFSUyaN
- TLSH
  T151033A4087ECC517EAEB5F78A8B4856107BABEC37DA1D7980D88B1E90C73BD055113AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Nudge\lib\WebView2Loader.dll
- Size 190KB
- SHA256 3426dcc55fdfb8b5e7ac623cf33b4ccf283fbf68a0c5a65bddfdb4d749a8abee
- MD5 f1426c839cbf0e9a4eae7c67916cedff
- SHA1 60cdeba80ce6357d9598947bd65f2db31e5efa2c
- SHA512 392d172f8e960a2d18d18175813e091c27d12065db06c4fcaabb6429bbb1306a3087fff33e51bf9226759b34d454109c11a310711ff9f7c6f9d8f78164b661f3
- SSDEEP 3072:hJoWXgNjIFnTf75x2v/KUUbPXGUIufAuzA2dTZnaZED3JU9jfbKuFjaS3:LKI175Av/KLB9zz3nyED3JU9DKC
- TLSH
  T142145D06B3E940F6F976D67C89A38A46F67278110710AAEF0360473D5F2BBD49A3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Nudge\tools\apply-update.ps1
- Size 2KB
- SHA256 d1bb6583838d6c8afcbe446fb521cfd9be17d24a112877f7ae2ee95576dfbda5
- MD5 3f4f2e75d9f23711bbb09f92acafd430
- SHA1 579f0912cf7195e3f7de660b77f2d950724e9249
- SHA512 1fb9bab6ba073f188d4989526f94b02090fe46cc2dc0dddfd7c45084248d23e6ec4a3443d66c098e8a2f642e25219a77b0af2730af3da9f70930b3e1b9c0a63f
- TLSH
  T1D05185076A3576664AC623E1F8C091845A1E809FD4B98E21A0DDD3C7DFF2D3F0B6C681
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  Nudge\tools\install.ps1
- Size 4KB
- SHA256 74b6f5fa365d887db7101fe91fc0c64ed1b732cc5c4999148535a83870353756
- MD5 c1152c05f3bc024fa210028847f9885d
- SHA1 ee0fef223ece3afa243cb46aaf0172c94f253b6b
- SHA512 e6c8f1d34a21fd60045a4dfccc2af670b5c798c97823f4d2da8dab815c466888878aabdb637289722a2e02400e9a12abf71fd549683765f630ab17d71588473c
- SSDEEP 96:NSWWsuoOmivpu9lyTNcG27P0EWRpFc82VnMkvRiKwsYmLojFBP2EU+Mi4FqN:NMrm6clyTNcrz0ELVpZNYCUfUr/e
- TLSH
  T12CA10A05A0372C57E5E23F44E2CA8304F5AE148ED0252312D64D9606FE67A7E9FAF3D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral10 behavioral11
- Target
  Nudge\tools\launcher.cs
- Size 2KB
- SHA256 ee542a6fe389343933a27f8aba6e97372a2d8157a1e22f3502a9921ef52b65cd
- MD5 afe94b9de012c42edefbb65646d5bc45
- SHA1 9028f810e3cb8217f3d94be2edcd81d252495014
- SHA512 23246308d4fc73e4916dce3a2786c16014bbedf7c438b0e9320d66de42d804ed31a0111b1d4165a545f1ed0b1c837798e2863e6978418eb2e0f72422fdb00fb9
- TLSH
  T11451C96D2CDEE59060C726217719D15A1AB3C34F8B36D8F1FADDC200BF2595C06B92B6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12 behavioral13
- Target
  Nudge\tools\make-icon.ps1
- Size 4KB
- SHA256 1a1b2b35d2c0c29db382bc5e16c033d306c80f31e06c8488eb6951d99fd2ee69
- MD5 613a57e7ab059da28bb6c5bc0a8aefe8
- SHA1 05f171d5c429a3941b0865a1acf07bb135c617d0
- SHA512 debb65132c11c6f636c69c1b2775ff3b35c91bba4b26b7c573119b7ae88ccb7601d3bc5e96ca0d758365a2961070f4973a8eb664b2ed07abaed9abd68438dc59
- SSDEEP 96:HqsFQ8yOaspm9Zk5pb8M317LB/97JXWbee9tLf3V:r++aspm9qXb8M317LB17JXWbeU5N
- TLSH
  T1A191B81962FBFEC98B951255E5A8C812DBFA41348245EC0C338EF54DB793EAD053D264
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  Nudge\tray.ps1
- Size 31KB
- SHA256 528b4e36bd0ef21312fc4cb8a621525f17056b5aa86f7885b47d46860c993001
- MD5 0df5701c507d99e3ff7b642bae740fb3
- SHA1 d755e668081dfbcd6118b557d2f781080717ca7b
- SHA512 13d24d9938974d8803db64e21074e49827d67bf232b8a2b8d3bca1a38a1cc66538398ed0273e8304d3c7b75243a79c987712088d852af2a76b310fc38b193d26
- SSDEEP 384:b32G1aT/Wm/pvUKAeXL0A1FiNBpGDThMzO24WBkxjlmsX/a62u5r6442XfqKU28b:v2rkm3OC24gkxnAUTvsjRxHiKy/weE
- TLSH
  T181E20B20AE3BE8254AC265B66DD6C048FBAE202DD2249B64B3DED1D0FF5157C47FC690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  Nudge\ui\index.html
- Size 86KB
- SHA256 b108a39245c18aeb74c4c588a44059e9cd10ac61fd2655563a14ace5687bea50
- MD5 15d39afe9650bb39b97f7b28dda644d2
- SHA1 472892990355a0d19261b05a3649496d3ff015e2
- SHA512 48dd7aa941c8c476f709ce668e985135e4ce448ff7cda85c526088a5288f1cd01c42db7ba3257bc48bea47f4f31d2b2434741e6130f62c1c4486b2bd3bfc5b04
- SSDEEP 1536:1wzBO99BpSh1bWUlL/hh+JneJkPUXJ2xOFUjDsES71qAyaCcgrhWLnPuUVVU:pObNIJneJWOejDZSpqChg9WLnPuUI
- TLSH
  T1B3935DF361B2313D042361D8B78AA15DF228950DCB46C5B1FD1C9444EFCAEB1AAFDA46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  Nudge\update.ps1
- Size 9KB
- SHA256 c7fdba6453147574648bbf10ed7c96148e44a7efd98e688ebfea18106fc56071
- MD5 a2a21edc225088afcb4d62931306249a
- SHA1 ad2629619883cb0dab248b83b5caaf216d36cf29
- SHA512 7daae5d66cb15b293c030c845c5fa7c1532866074c22b110e7d17c1ccbca3ea3650d5cec04d9f1874d08b4de2835adac5456ab7f05f89bdd87f464a0500f951c
- SSDEEP 192:5aCIM66fV5agczVlCn7KC7wC2lxYTtvaC3//A0s1h4H3C4d0CoYOoCbQik7cSjZM:5aC/dV5ag1rRh3HPsv4S4d7oYOfQ7VZM
- TLSH
  T118121B695D93D9394AC2165E68895010B7AF801C53219F60F6EED488FFF02BECF5D1E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21