General

  • Target

    VMware-workstation-full-16.1.0-17198959.exe

  • Size

    621.5MB

  • Sample

    221229-rdm4zsdb83

  • MD5

    dfd804f813a483907ec996ced444af66

  • SHA1

    7c02662a7570608e61c86a9859eda7b0f661a177

  • SHA256

    342e92eed1ed1b90b11eda462d5bfc40252cdfdd247112be00fba51d4f8f7525

  • SHA512

    5bc16b36935727cb4677072ba21e7fa76f666f0e96e9600407816e1d06a312b14f71130fbc4c44e75d45589daf24e60b4b9a81bf5cd5be0fa44c556a9f01e4c1

  • SSDEEP

    12582912:Hn5g801yqFhUkmOTziM0tDLvHD5Vk1yzmrms1PEoEzSDe04De0SU7:H1iyqFhiKziMUvHD81yzmrms1PpEGDe/

Malware Config

Extracted

Path

C:\Program Files (x86)\VMware\VMware Workstation\open_source_licenses.txt

Ransom Note
open_source_license.txt VMware Workstation 16.1.0 Pro and VMware Workstation 16.1.0 Player GA ====================================================================== The following copyright statements and licenses apply to various open source software packages (or portions thereof) that are distributed with this VMware Product. The VMware Product may also include other VMware components, which may contain additional open source software packages. One or more such open_source_licenses.txt files may therefore accompany this VMware Product. The VMware Product that includes this file does not necessarily use all the open source software packages referred to below and may also only use portions of a given package. =============== TABLE OF CONTENTS ============================= The following is a listing of the open source components detailed in this document. This list is provided for your convenience; please read further if you wish to review the copyright notice(s) and the full text of the license associated with each component. SECTION 1: Academic Free License, V2.1 >>> dbus-1.4.16 SECTION 2: Apache License, V2.0 >>> api-deeac25edd38b173745110ad6f08736c624f7dc2 >>> api-v0.17.0 >>> apiextensions-apiserver-kubernetes-1.13.1 >>> apimachinery-kubernetes-1.13.0 >>> apimachinery-v0.17.0 >>> apiserver-5838f549963bed8c4af81f430f23a29eccad093e >>> appengine-v1.5.0 >>> buildkit-v0.0.0-20191111154543-00bfbab0390c >>> checkpoint-restore_go-criu-17b0214f6c48 >>> client-go-kubernetes-1.13.1 >>> cloud-provider-e954a34baf4322841681c84ffb783e3fed4b6a2d >>> cobra-v0.0.5 >>> component-base-v1.15.6-beta.0.0.20191104184701-167f3796caf4 >>> console-v0.0.0-20200413145205-82d30a103c0a >>> containerd-1.3.2 >>> containerd_cgroups-80b32e3c75c9 >>> containerd_console-4d8a41f4ce5b >>> containerd_console-53a0f1deb970 >>> containerd_containerd-v1.2.0 >>> containerd_containerd-v1.3.2 >>> containerd_containerd_mount-v1.2.0 >>> containerd_containerd_mount-v1.3.2 >>> containerd_containerd_sys-v1.2.0 >>> containerd_containerd_sys-v1.3.2 >>> containerd_continuity-aaeac12a7ffc >>> containerd_continuity-f65d91d395eb >>> containerd_cri-containerd-v1.11.1 >>> containerd_fifo-ff969a566b00 >>> containerd_go-runc-5a6d9f37cfa3 >>> containerd_typeurl-5eb25027c9fd >>> coredns-v1.6.7+vmware.1 >>> coreos_go-systemd-95778dfbb74e >>> coreos_pkg-97fdf19511ea >>> cri-api-v1.15.6-beta.0.0.20191104184701-167f3796caf4 >>> docker-machine-driver-vmware-aaccce554f6a23a80205520ade5b928d47ee9dec >>> docker-v0.0.0-20190319215453-e7b5f7dbe98c >>> docker_distribution-aa985ba8897a >>> docker_distribution-v2.7.1 >>> docker_docker-be7ac8be2ae0 >>> docker_docker-v1.13.1 >>> docker_go-events-e31b211e4f1c >>> docker_go-units-v0.3.3 >>> docker_go-units-v0.4.0 >>> docker_spdystream-bc6354cbbc29 >>> genproto-24fa4b261c55 >>> genproto-c66870c02cf8 >>> go-containerregistry-v0.0.0-20200413145205-82d30a103c0a >>> go_opencensus_io-v0.22.0 >>> gogo_googleapis-v1.3.0 >>> golang_glog-23def4e6c14b >>> golang_groupcache-c65c006176ff >>> goodhosts/hostsfile-v0.0.4 >>> google_gofuzz-24818f796faf >>> google_gofuzz-v1.0.0 >>> googleapis_gnostic-0c5108395e2d >>> grpc-v1.26.0 >>> grpc-v1.8.0 >>> grpc/grpc-go-1.25.1 >>> inconshreveable_mousetrap-v1.0.0 >>> kaniko-v.0.14.0 >>> kind-0.6.0 >>> kind-windows-amd64-v0.8.1 >>> klog-v0.3.1 >>> klog-v1.0.0 >>> kube-openapi-b3a7cee44a30 >>> kubectl-1.18.6 >>> kubernetes-5bb11dc58843dc961572d49fd8b90fd387c9a4c7 >>> kubernetes/apimachinery-1.16.3 >>> legacy-cloud-providers-v1.15.6-beta.0.0.20191104184701-167f3796caf4 >>> matttproud_golang_protobuf_extensions-v1.0.1 >>> modern-go_concurrent-bacd9c7ef1dd >>> modern-go_reflect2-v1.0.1 >>> mrunalp_fileutils-7d4729fb3618 >>> netlink-v0.0.0-20180723181557-2cbcf73e3dcd >>> netns-v0.0.0-20180720170159-13995c7128cc >>> opencontainers_go-digest-v1.0.0 >>> opencontainers_image-spec-v1.0.1 >>> opencontainers_runc-v0.1.1 >>> opencontainers_runc_libcontainer-c31425a30e7c7d5ccfccda9a3159b1ad4e2e2ee0 >>> opencontainers_runtime-spec-5684b8af48c1 >>> opencontainers_runtime-spec-v1.0.1 >>> opencontainers_selinux-v1.2.2 >>> opentracing_opentracing-go-v1.1.0 >>> prometheus_client_golang-v0.9.2 >>> prometheus_client_model-fd36f4220a90 >>> prometheus_common-v0.3.0 >>> prometheus_node_exporter_collector-v0.18.1 >>> prometheus_procfs-65bdadfa96ae >>> spf13_afero-b28a7effac97 >>> spf13_afero-v1.2.2 >>> spf13_cobra-v0.0.5 >>> swagger-ui-2.11-M2 >>> utils-c2654d5206da >>> vishvananda_netlink-2cbcf73e3dcd >>> vishvananda_netns-13995c7128cc >>> vmware_govmomi-v0.20.1 >>> vmware_govmomi_vim25_xml-v0.20.1 >>> yaml.v2-v2.2.8 >>> yaml_v2-v2.2.4 SECTION 3: BSD-STYLE, MIT-STYLE, OR SIMILAR STYLE LICENSES >>> Python-3.7.2 >>> ThinPrint-10.0.175 >>> UTF-8-decoder-C99 >>> alecthomas_kingpin_v2-v2.2.6 >>> alecthomas_template-a0175ee3bccc >>> alecthomas_units-2efee857e7cf >>> atomic-v1.3.2 >>> azure_go-ansiterm-d6e3b3328b78 >>> beevik_ntp-v0.2.0 >>> beorn7_perks-v1.0.0 >>> boost-1.61 >>> cityhash-1.0.3 >>> cpuguy83_go-md2man_v2-f79a8a8ca69d >>> curl-7.65.3 >>> cvt-2.0.6 >>> cyphar_filepath-securejoin-v0.2.1 >>> davecgh_go-spew-v1.1.1 >>> diod-1.0.24 >>> docker/docker-credential-helpers-v0.6.3 >>> docker_docker_pkg_symlink-be7ac8be2ae0 >>> dxsdk-nov2007 >>> e1000-efi-3.5.09 >>> e1000e-efi-4.0.15 >>> edk2-2 >>> edk2-fat-driver-58 >>> egl-extapi-2013.0 >>> ema_qdisc-b307c22d3ce7 >>> evanphx_json-patch-v3.0.0 >>> expat-2.2.7 >>> fastlz-0.1.0 >>> fontconfig-2.13.0 >>> freebsd-base64-4.8 >>> freebsd-iso9660-6.0 >>> freetype-2.9 >>> fsnotify_fsnotify-v1.4.7 >>> fsutil-v0.0.0-20191018213012-0f039a052ca1 >>> gcfg_v1-v1.2.3 >>> getopt.c-none-vmwmisc >>> github.com/Microsoft/go-winio-v0.4.15-0.20190919025122-fc70bd9a86b5 >>> godbus_dbus-271e53dc4968 >>> godbus_dbus-ade71ed3457e >>> gofrs/flock-v0.7.0 >>> gogo/protobuf-v1.3.1 >>> gogo_protobuf_gogoproto-v1.1.1 >>> gogo_protobuf_gogoproto-v1.3.0 >>> gogo_protobuf_proto-v1.1.1 >>> gogo_protobuf_proto-v1.3.1 >>> gogo_protobuf_protoc-gen-gogo_descriptor-v1.1.1 >>> gogo_protobuf_protoc-gen-gogo_descriptor-v1.3.0 >>> gogo_protobuf_sortkeys-v1.1.1 >>> gogo_protobuf_sortkeys-v1.3.1 >>> gogo_protobuf_types-v1.3.1 >>> golang.org/x/net-1c05540f6879653db88113bc4a2b70aec4bd491f >>> golang.org/x/sys-810d7000345868fc619eb81f46307107118f4ae1 >>> golang_protobuf-v1.3.1 >>> golang_protobuf-v1.3.2 >>> google_go-cmp-v0.3.0 >>> google_uuid-v1.0.0 >>> gorilla_mux-v1.7.0 >>> grab-2.0 >>> harfbuzz-1.3.2 >>> hodgesds_perf-utils-v0.0.7 >>> icu-data-4.4-1 >>> inf_v0-v0.9.1 >>> insomniacslk_dhcp-393ae75a101b4e8d93f82dd7242401dd50ac0868 >>> jansson-2.10 >>> json-iterator_go-ab8a2e0c74be >>> keybase_go-ps-91aafc93ba19 >>> keybase_go-ps_darwincgo-91aafc93ba19 >>> konsorten_go-windows-terminal-sequences-v1.0.2 >>> kr_fs-2788f0dbd169 >>> kubernetes_third_party_forked_golang-v1.15.6-beta.0.0.20191104184701-167f3796caf4 >>> libepoxy-1.4.0 >>> libffi-3.2.1 >>> libjpeg-turbo-2.0.5 >>> libogg-1.3.2 >>> libopus-1.1.4 >>> libpng-1.6.37 >>> libspeexdsp-1.2rc3 >>> libtiff-4.1.0 >>> libvorbis-1.3.5 >>> libxdr-openbsd-4.3 >>> libxml2-2.9.10 >>> libyuv-r1662 >>> lufia_iostat-9f7362b77ad3 >>> lumberjack-2.1 >>> magiconair_properties-v1.8.1 >>> mattn_go-xmlrpc-v0.0.1 >>> mdlayher_genetlink-e97704c1b795 >>> mdlayher_netlink-e069752bc835 >>> mdlayher_vsock-4b4b46fb16ba >>> mdlayher_wifi-efdf3f4195d9 >>> mesa-10.6.0 >>> microsoft_go-winio-fc70bd9a86b5 >>> microsoft_go-winio-v0.4.12 >>> microsoft_hcsshim-v0.8.6 >>> microsoft_hcsshim-v0.8.7 >>> mitchellh_go-homedir-v1.1.0 >>> mitchellh_mapstructure-v1.1.2 >>> multierr-v1.1.0 >>> ncurses-5.5 >>> openssl-1.0.2v >>> p11-kit-0.23.2 >>> pcre-8.44 >>> pcsc-lite-1.4.4 >>> pelletier_go-toml-v1.4.0 >>> phayes_permbits-529f712b661a >>> pixman-0.34.0 >>> pkg_errors-v0.8.0 >>> pkg_errors-v0.8.1 >>> pkg_sftp-4d0e916071f6 >>> prometheus_common_internal_bitbucket_org_ww_goautoneg-v0.3.0 >>> protobuf-3.6.1 >>> protobuf-c-1.2.1 >>> russross_blackfriday_v2-v2.0.1 >>> seccomp_libseccomp-golang-v0.9.0 >>> sha256-8/26/2003 >>> shurcool_sanitized_anchor_name-v1.0.0 >>> sirupsen_logrus-v1.4.1 >>> sirupsen_logrus-v1.4.2 >>> soundcloud_go-runit-06ad41a06c4a >>> spf13_cast-v1.3.0 >>> spf13_jwalterweatherman-v1.1.0 >>> spf13_pflag-v1.0.1 >>> spf13_pflag-v1.0.3 >>> spf13_viper-v1.5.0 >>> sqlite-3.32.3 >>> startup-notification-0.9 >>> stretchr/testify-1.4.0 >>> subosito_gotenv-v1.2.0 >>> syndtr_gocapability-33e07d32887e >>> syndtr_gocapability-d98352740cb2 >>> tchap_go-patricia-v2.3.0 >>> tcp-wrappers-7.6-1 >>> u-root/u-root-v6.0.0 >>> urfave_cli-v1.22.1 >>> warnings_v0-v0.1.2 >>> x_crypto-c2843e01d9a2 >>> x_net-cdfb69ac37fc >>> x_oauth2-9f3314589c9a >>> x_sync-112230192c58 >>> x_sys-2953c62de483 >>> x_text-e6919f6577db >>> x_text-v0.3.2 >>> x_time-85acf8d2951c >>> xorg-7.7 >>> yaml-v1.1.0 >>> zip-3.0 >>> zlib-1.2.11 SECTION 4: Common Development and Distribution License, V1.1 >>> siebenmann_go-kstat-d34789b79745 SECTION 5: GNU General Public License, V2.0 >>> atkmm-2.22.7 >>> cdrtools-2.01 >>> fuse-2.9.4 >>> gksu-2.0.2 >>> libfuse-2.9.4 >>> libgtop-2.34.1 >>> libudev-163 SECTION 6: GNU General Public License, V3.0 >>> gcc-4.8.4 >>> gettext-runtime-0.20.1 SECTION 7: GNU Lesser General Public License, V2.1 >>> 7zip-18.05 >>> Libgpg-error-1.27 >>> alsa-lib-1.0.13 >>> cairo-1.16.0 >>> glibmm-2.40.0 >>> gtkmm-3.10.1 >>> libgcrypt-1.8.5 >>> libsigc++-2.4.1 >>> libtasn1-4.9 >>> libusb-1.0.9 >>> pangomm-2.34.0 >>> pulseaudio-0.9.22 >>> vte-0.44.3 SECTION 8: GNU Library General Public License, V2.0 >>> at-spi2-atk-2.10.2 >>> at-spi2-core-2.10.2 >>> atk-2.28.1 >>> cairomm-1.10.0 >>> gcr-3.20.0 >>> gdk-pixbuf-2.36.11 >>> glib-2.48.2 >>> gtk+-3.14.15 >>> libaio-0.3.106 >>> libcroco-0.6.11 >>> libgksu-2.0.12 >>> libiconv-1.15 >>> librsvg-2.40.21 >>> pango-1.40.13 >>> zenity-3.22.0 SECTION 9: Microsoft Permissive Public License >>> wtl-9.1 SECTION 10: Mozilla Public License, V2.0 >>> hashicorp_golang-lru-v0.5.0 >>> hashicorp_golang-lru-v0.5.1 >>> hashicorp_hcl-v1.0.0 SECTION 11: Q Public License, V1.0 >>> ocaml-3.12.1 APPENDIX. Standard License Files >>> Academic Free License, V2.1 >>> Apache License, V2.0 >>> Apache License, V2.0 >>> Common Development and Distribution License, V1.1 >>> GNU General Public License, V2.0 >>> GNU General Public License, V3.0 >>> GNU Library General Public License, V2.0 >>> GNU Lesser General Public License, V2.1 >>> Mozilla Public License, V2.0 >>> Microsoft Permissive Public License >>> Q Public License, V1.0 --------------- SECTION 1: Academic Free License, V2.1 ---------- Academic Free License, V2.1 is applicable to the following component(s). >>> dbus-1.4.16 [PLEASE NOTE: VMWARE, INC. ELECTS TO USE AND DISTRIBUTE THIS COMPONENT UNDER THE TERMS OF THE AFL 2.1. PLEASE SEE THE ORIGINAL LICENSE TERMS ARE REPRODUCED BELOW ONLY AS A REFERENCE.] Copyright (C) 2007 Red Hat, Inc. Licensed under the Academic Free License version 2.1 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ADDITIONAL LICENSE INFORMATION: > MIT dbus-1.4.16\dbus-1.4.16.tar.gz\dbus-1.4.16.tar\dbus-1.4.16\m4\compiler.m4 Copyright © 2005 Scott James Remnant <[email protected]>. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. > BSD dbus-1.4.16\dbus-1.4.16.tar.gz\dbus-1.4.16.tar\dbus-1.4.16\tools\strtoll.c Copyright (c) 1992, 1993 The Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 4. Neither the name of the University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --------------- SECTION 2: Apache License, V2.0 ---------- Apache License, V2.0 is applicable to the following component(s). >>> api-deeac25edd38b173745110ad6f08736c624f7dc2 Copyright 2018 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License
Emails

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

[email protected]

[email protected]\[email protected]\[email protected]\contrib\init\openrc\docker.initd]

[email protected]\[email protected]\[email protected]\contrib\init\openrc\docker.initd

[email protected]\[email protected]\[email protected]\NOTICE

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

[email protected]

<[email protected]>

<[email protected]>

<[email protected]>

URLs

http://www.apache.org/licenses/LICENSE-2.0

http:github.com/gogo/protobuf

http://github.com/gogo/protobuf

https://github.com/golang/protobuf

https://www.docker.com

https://www.bis.doc.gov

https://www.apache.org/dev/crypto.html

http:www.apache.org/licenses/LICENSE-2.0

http://www.coreos.com/

http:www.coreos.com/

http://www.apache.org/licenses/

https://github.com/kr/pty

https:github.com/pivotal-golang/s3cli

http://creativecommons.org/licenses/by/4.0/

https://www.apache.org/licenses/LICENSE-2.0

https://github.com/sigu-399

http://ernestmicklei.com

http://opensource.org/licenses/mit-license.php

http://creativecommons.org/publicdomain/zero/1.0/

http://www.apache.org/licenses/LICENSE-2.0>

Targets

    • Target

      VMware-workstation-full-16.1.0-17198959.exe

    • Size

      621.5MB

    • MD5

      dfd804f813a483907ec996ced444af66

    • SHA1

      7c02662a7570608e61c86a9859eda7b0f661a177

    • SHA256

      342e92eed1ed1b90b11eda462d5bfc40252cdfdd247112be00fba51d4f8f7525

    • SHA512

      5bc16b36935727cb4677072ba21e7fa76f666f0e96e9600407816e1d06a312b14f71130fbc4c44e75d45589daf24e60b4b9a81bf5cd5be0fa44c556a9f01e4c1

    • SSDEEP

      12582912:Hn5g801yqFhUkmOTziM0tDLvHD5Vk1yzmrms1PEoEzSDe04De0SU7:H1iyqFhiKziMUvHD81yzmrms1PpEGDe/

    • Detect jar appended to MSI

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

    • Registers COM server for autorun

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks