General

  • Target

    Telegram Desktop (19).msi

  • Size

    188.9MB

  • Sample

    221126-g515tacb6w

  • MD5

    0f4b7f6da9b1375839b3e96dd2ca8c3d

  • SHA1

    d7c72fa3e4972152dda761682ab3e80b44842283

  • SHA256

    251dba4d350685d32c16d0b555a1dc13d095d7a64399d01e9d9149f22a23dc1c

  • SHA512

    928395df18eacf4b189e0d04fb9c4ed9df90c406717dfc8f1e98a7cb0ed64d97848a6c34522005a58d647d340f96c28f50ccb8526e80e7079a06dc7ce7f25c41

  • SSDEEP

    3145728:t8eWmtYoa0bEut/C6LOJCIx7p0pQMyAC5kndaZcee3iaASySuiNfX1XlL:tlTtYBcEs3KCIx7qWMjTeEOSyJiv

Score
10/10

Malware Config

Extracted

Path

C:\Program Files\Wizards of the Coast\MTGA\MTGA_Data\Plugins\ThirdPartyNotices.txt

Ransom Note
This production is brought to you, in part, by the following libraries. Most of the libraries listed below are parts of the Chromium web browser, embedded using CEF: https://www.chromium.org/Home https://bitbucket.org/chromiumembedded/cef The files that primarily contain code from Chromium are the zf_cef.dll/so (normally named libcef.dll/so) and "Chromium Embedded Framework" shared libraries. Note that some of the libraries listed below are only used as tools during building and development and are not included with this product. Check the Chromium source code for details. ----------------------------------------------------------------------- OpenVR C# Bindings 1.0.10 https://github.com/ValveSoftware/openvr/blob/master/headers/openvr_api.cs ----------------------------------------------------------------------- Copyright (c) 2015, Valve Corporation All rights reserved. --- See BSD License (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- SimpleJson.cs https://github.com/facebook-csharp-sdk/simple-json ----------------------------------------------------------------------- Copyright (c) 2011, The Outercurve Foundation, 2015 Zen Fulcrum LLC Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.opensource.org/licenses/mit-license.php Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Nathan Totten (ntotten.com), Jim Zimmerman (jimzimmerman.com), Prabir Shrestha (prabir.me), Jonathan Stephens ----------------------------------------------------------------------- ----------------------------------------------------------------------- C-Sharp-Promise https://github.com/Real-Serious-Games/C-Sharp-Promise ----------------------------------------------------------------------- The MIT License (MIT) Copyright (c) 2014 Real Serious Games --- See MIT License at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- libX11 https://www.x.org/wiki/ ----------------------------------------------------------------------- Copyright © 1985, 1986, 1987, 1988, 1989, 1991, 1994, 1996, 2002 The Open Group Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of The Open Group shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from The Open Group. Copyright © 1985, 1986, 1987, 1988, 1989, 1991 Digital Equipment Corporation Permission to use, copy, modify and distribute this documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the names of Digital and Tetronix not be used in in advertising or publicity pertaining to distribution of the software without specific, written prior permission. Digital and Tetronix make no representations about the suitability of the software described herein for any purpose. It is provided “as is” without express or implied warranty. TekHVC is a trademark of Tektronix, Inc. ----------------------------------------------------------------------- ----------------------------------------------------------------------- Chromium Embedded Framework https://bitbucket.org/chromiumembedded/cef/ ----------------------------------------------------------------------- Copyright (c) 2008-2014 Marshall A. Greenblatt. Portions Copyright (c) 2006-2009 Google Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Google Inc. nor the name Chromium Embedded Framework nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ----------------------------------------------------------------------- ----------------------------------------------------------------------- (Components of) Bazel https://github.com/bazelbuild/bazel ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- AXE-CORE Accessibility Audit https://github.com/dequelabs/axe-core/ ----------------------------------------------------------------------- --- See Mozilla Public License (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Accessibility Audit library, from Accessibility Developer Tools https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Alliance for Open Media Video Codec https://aomedia.googlesource.com/aom/ ----------------------------------------------------------------------- Copyright (c) 2016, Alliance for Open Media. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ----------------------------------------------------------------------- ----------------------------------------------------------------------- Almost Native Graphics Layer Engine http://code.google.com/p/angleproject/ ----------------------------------------------------------------------- // Copyright (C) 2002-2013 The ANGLE Project Authors. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions // are met: // // Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // // Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following // disclaimer in the documentation and/or other materials provided // with the distribution. // // Neither the name of TransGaming Inc., Google Inc., 3DLabs Inc. // Ltd., nor the names of their contributors may be used to endorse // or promote products derived from this software without specific // prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS // FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE // COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, // INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, // BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT // LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN // ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE // POSSIBILITY OF SUCH DAMAGE. ----------------------------------------------------------------------- ----------------------------------------------------------------------- American Fuzzy Lop http://lcamtuf.coredump.cx/afl/ ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android http://source.android.com/ ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android Crazy Linker https://chromium.googlesource.com/chromium/src.git/+/master/third_party/android_crazy_linker/ ----------------------------------------------------------------------- // Copyright 2014 The Chromium Authors. All rights reserved. // // --- See BSD License (Google) at the end of this file --- Copyright (C) 2012 The Android Open Source Project * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android Explicit Synchronization http://source.android.com/ ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android FloatProperty https://developer.android.com/reference/android/util/FloatProperty.html ----------------------------------------------------------------------- Copyright (c) 2005-2008, The Android Open Source Project Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --- See Apache License (A) at the end of this file --- APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2011 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License
Emails

[email protected]

<[email protected]>

[email protected]

[email protected]

[email protected]

[email protected]

<[email protected]>

[email protected]

[email protected]

<[email protected]>

[email protected]

[email protected]

[email protected]

[email protected])"

[email protected])"

[email protected]

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

URLs

https://www.chromium.org/Home

https://bitbucket.org/chromiumembedded/cef

https://github.com/ValveSoftware/openvr/blob/master/headers/openvr_api.cs

https://github.com/facebook-csharp-sdk/simple-json

http://www.opensource.org/licenses/mit-license.php

https://github.com/Real-Serious-Games/C-Sharp-Promise

https://www.x.org/wiki/

https://bitbucket.org/chromiumembedded/cef/

https://github.com/bazelbuild/bazel

https://github.com/dequelabs/axe-core/

https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js

https://aomedia.googlesource.com/aom/

http://code.google.com/p/angleproject/

http://lcamtuf.coredump.cx/afl/

http://source.android.com/

https://chromium.googlesource.com/chromium/src.git/+/master/third_party/android_crazy_linker/

https://developer.android.com/reference/android/util/FloatProperty.html

http://www.apache.org/licenses/LICENSE-2.0

https://android.googlesource.com/platform/frameworks/support

https://android.googlesource.com/platform/packages/apps/Settings/

Targets

    • Target

      Telegram Desktop (19).msi

    • Size

      188.9MB

    • MD5

      0f4b7f6da9b1375839b3e96dd2ca8c3d

    • SHA1

      d7c72fa3e4972152dda761682ab3e80b44842283

    • SHA256

      251dba4d350685d32c16d0b555a1dc13d095d7a64399d01e9d9149f22a23dc1c

    • SHA512

      928395df18eacf4b189e0d04fb9c4ed9df90c406717dfc8f1e98a7cb0ed64d97848a6c34522005a58d647d340f96c28f50ccb8526e80e7079a06dc7ce7f25c41

    • SSDEEP

      3145728:t8eWmtYoa0bEut/C6LOJCIx7p0pQMyAC5kndaZcee3iaASySuiNfX1XlL:tlTtYBcEs3KCIx7qWMjTeEOSyJiv

    Score
    10/10
    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Tasks