088a9f665d0fdc9b2bb050ecd1524b1539010bbe1d9935f72343bb2bc5f98975

Sharing

Copy URL

Twitter E-mail

General

Target

Launcher.exe
Size

84.3MB
Sample

240428-rzn86shh88
MD5

ddd88df7eb98fe2d58a53ab5511319be
SHA1

cff75793347a393056664370bec62712fdd90f21
SHA256

088a9f665d0fdc9b2bb050ecd1524b1539010bbe1d9935f72343bb2bc5f98975
SHA512

9c7f37b8ec9293b6606b41391ff9e7115c176f60735b4214d8e2b00513f7e40eba8aaf9fddfe90a261cb1b515fa921514ffc3d31acb32a9e70c26ea37b10c5a0
SSDEEP

1572864:+4gPXMo0EPUW3PeaRqjIPY78z0XBkCb0BanmtUFk4rad57:+4Act4PPtqjh784Nctey4Od57

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  Launcher.exe
- Size
  
  84.3MB
- MD5
  
  ddd88df7eb98fe2d58a53ab5511319be
- SHA1
  
  cff75793347a393056664370bec62712fdd90f21
- SHA256
  
  088a9f665d0fdc9b2bb050ecd1524b1539010bbe1d9935f72343bb2bc5f98975
- SHA512
  
  9c7f37b8ec9293b6606b41391ff9e7115c176f60735b4214d8e2b00513f7e40eba8aaf9fddfe90a261cb1b515fa921514ffc3d31acb32a9e70c26ea37b10c5a0
- SSDEEP
  
  1572864:+4gPXMo0EPUW3PeaRqjIPY78z0XBkCb0BanmtUFk4rad57:+4Act4PPtqjh784Nctey4Od57
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  LICENSES.chromium.html
- Size
  
  8.8MB
- MD5
  
  2675b30d524b6c79b6cee41af86fc619
- SHA1
  
  407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA256
  
  6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- SHA512
  
  3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP
  
  24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
Score

1^/10
behavioral4
- Target
  
  Launcher.exe
- Size
  
  164.9MB
- MD5
  
  69297f39ec0be1969de6409a310264d1
- SHA1
  
  7c0e7ead5bd451a95cd6062eb0fb4a5c053f7190
- SHA256
  
  22117115927d13aee3314c659efe6253692ec3555b2b3e602d512067d71e0b98
- SHA512
  
  2c6b82ee7d76d227b35e75aed7521a6d939a1f8abe8a031202ec2c56832a3c131a82b006e53be05e0937b461e3a0cdeff8f1f71f1e4e61fb01bc592cd0ee5b57
- SSDEEP
  
  1572864:Ftc2cEGwGrRSREICCr3ka8YrcSAfII01aLadS5sDNd+Ipx9cF3LfxNEK2Ho8jlgY:b+CHrJIgIsV
Score

7^/10
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral5
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral6
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  22d50afb406613ac0789e382ce32313b
- SHA1
  
  b9178d1aa98cd33c0b7e092aa0aebc97ed256a06
- SHA256
  
  bf744924cf808c38d4f5762dcdda440b2f6b491794ca0c46c15a04d3297d6a1a
- SHA512
  
  dc73666abff6ba7f521f2443d4273076b12b289a47581a3beaf7f6a358f381eb70f9cc0039cdea7a271667a55c52de54b354a005481a65b9afda2505e697d62a
- SSDEEP
  
  49152:RF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQWSCu:RFvSkJXv+tiLAD0+DWS5
Score

1^/10
behavioral7
- Target
  
  libEGL.dll
- Size
  
  477KB
- MD5
  
  e624a4ce2174b99bf0f79dda1ce7a77b
- SHA1
  
  a823daf4e44a1d49fd6c83bca47da72de5cd3c94
- SHA256
  
  43d0e9d697ea51e229d4ccc53cdfeec54c79d6745071ef882dc5d651ae91fc6b
- SHA512
  
  e56f8ed42e8edb85e7e5ad2645b1c51883137dfd80ad6e62f95a1915a8368c03231c2c17bf57722ed61529ae39116dbaf51191b0640ed9ce634703425f300c89
- SSDEEP
  
  6144:r8hd1BSjuMmof2SEXVVfgV8hxN7h2NdIEOg51f0FticyQ:r8DXSjZmof2SEsmN12NdIE7f0FticyQ
Score

1^/10
behavioral8
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  6202ae2b5c4e131abc14aa25747300b8
- SHA1
  
  af3f8f11aac179476c09ee2a34b14fbb88531ee5
- SHA256
  
  798c4173428eccea4950d20662312a42f622c3936cc9e2e1e86f1c2b832274da
- SHA512
  
  ec26b39af649aa86f65e85e598b6bb96ed2193667115e8292227553b6597948fb9bf71b11f85e9dfb982fed330e72d9aa5d7ec120937810d7b40b1c6879d01f8
- SSDEEP
  
  98304:8wY1sQqaLe2Egto8U4r5Pp6TlITQZ3QW888888888tb8dDi:TNaSgtvroZQ
Score

1^/10
behavioral9
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral10
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  e31749b045043630542af612b5bb7f13
- SHA1
  
  e3a5e1087c228f107fd091a760094aa8fdcd01e7
- SHA256
  
  2bf61db50d0226c079c7b6516f36e76b46d1ba35cbc483dd625d8c83bef70dcb
- SHA512
  
  8b53042146ebf46f7804d8922d128edbe381a2a748d9c608affe07f1c3d4ad1691bacdfb39fccf2ca73d10b2f0c58c220a765e8dbb5be9b2ae1413d3cb17f923
- SSDEEP
  
  49152:t6h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzG:4h3aMXoSHfPwksHldLiuNr
Score

1^/10
behavioral11
- Target
  
  vulkan-1.dll
- Size
  
  931KB
- MD5
  
  5a81c349355e332f4f8796f7b8e8be18
- SHA1
  
  646f50ce5e046e63ca2905a88b0c7d09e25a6dba
- SHA256
  
  699730471255f848f4d73ccc7bba22dfb9e3bb54c44121375e9bd9ef5c7de605
- SHA512
  
  baf82b77f780a514267428183423949aa61634a674cb700541100d047ee8e9654960e5f40048aed38c236fb00dd334fe3dfa3337eb3acec50fa2457345b89394
- SSDEEP
  
  24576:NYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7s5:NY65/M387R56Z5WoDYsHY6g3P0zAk7s
Score

1^/10
behavioral12
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral13

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Looks up external IP address via web service

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13