egregor | ffaa6ae5e499945093a6fe2a7a05504f8796127cd6f4de239b47a7e86715214c

Sharing

Copy URL

Twitter E-mail

General

Target

SampDroid Launcher.exe
Size

85.8MB
Sample

240213-gtwqysag2w
MD5

c81a4f96f3d0f00d437eb780f49e20da
SHA1

5b9a5c83860b0fe7c13519fc646f1448203128ba
SHA256

ffaa6ae5e499945093a6fe2a7a05504f8796127cd6f4de239b47a7e86715214c
SHA512

1a5fed6f43d3efd17bb142f344fa607a99ef36c46f204d32e53d9db4ddad2eeda452b56b6a6d463982e49323e819519776dc917c44418954cee4c8fe8bc7533f
SSDEEP

1572864:IkUyIesXWtDolfnCOKRwoc4tZJ7/ulwVY7znzHta6ZYbqZlN2A4ytJ8/9c2elsky:In4skgPvkwN4p7gr3zHtaPcl8Cr8/9cI

Score

10^/10

egregor upx

Malware Config

Targets

- Target
  
  SampDroid Launcher.exe
- Size
  
  85.8MB
- MD5
  
  c81a4f96f3d0f00d437eb780f49e20da
- SHA1
  
  5b9a5c83860b0fe7c13519fc646f1448203128ba
- SHA256
  
  ffaa6ae5e499945093a6fe2a7a05504f8796127cd6f4de239b47a7e86715214c
- SHA512
  
  1a5fed6f43d3efd17bb142f344fa607a99ef36c46f204d32e53d9db4ddad2eeda452b56b6a6d463982e49323e819519776dc917c44418954cee4c8fe8bc7533f
- SSDEEP
  
  1572864:IkUyIesXWtDolfnCOKRwoc4tZJ7/ulwVY7znzHta6ZYbqZlN2A4ytJ8/9c2elsky:In4skgPvkwN4p7gr3zHtaPcl8Cr8/9cI
Score

N/A
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  4.5MB
- MD5
  
  d4a79b5d46f0931b9eb7125fd40baff0
- SHA1
  
  3a38fb263dde2251b9fe157b5fddec7acb07c53e
- SHA256
  
  03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
- SHA512
  
  17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
- SSDEEP
  
  24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV
Score

1^/10
behavioral11 behavioral12
- Target
  
  SampDroid.exe
- Size
  
  120.4MB
- MD5
  
  8a4318c2a9f52f8bf99a62a4220d895f
- SHA1
  
  570a8978c012a390da251ef3d76dfd7364fdd18e
- SHA256
  
  2a91ed841fcf2c720c33f3fdbd10bd53adf3bdfc2e69f0dd96b1fd45a2ef5350
- SHA512
  
  7788ae81f663f8586515e9b3210e8bb2b5abcc6d0e31a359f7a751d9846b033ac58fdc2cb4e05c72475ae12d2870e3b0e29d8414f3618dcde0097be0ccc26fa8
- SSDEEP
  
  1572864:m1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:basulbg8yTnbEOz
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  eabfc10d56cb44a86493cb2f8ca7aab2
- SHA1
  
  09d7e87f43527333cd021329d6c2f4e8bd8ddab5
- SHA256
  
  42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6
- SHA512
  
  ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec
- SSDEEP
  
  49152:YISWBURglcWlJUQSyPV3cZ8RxDZa+DmXfUStDw/JcImohiiMoFwEgy:YPnvdZoJpMoQ
Score

1^/10
behavioral16 behavioral17
- Target
  
  launcher/SA-MP.exe
- Size
  
  14.8MB
- MD5
  
  f7874cc8637e5ddb98b07ed40a24de58
- SHA1
  
  0a9eac60f516a8661b5b2ae9f1d5d798ee7fecef
- SHA256
  
  550321da5b10c472bc719bca2c0df74b240f80eff828079eb5253598fe112ae3
- SHA512
  
  c0e2078d8bd1d6aeb8d6cc77ea935e41fb31c271f6503a3625d2bcbebf9a8b142a1d7856816381fb4be79a45e1ea6dbe8cdb8efa027f29c32faf52794c49f2b1
- SSDEEP
  
  393216:suNmflaNtY7G8t+LdFyBV9DVimtbA9yRbABehQtAuGuSwcBk:3NklUt3Nd2VvimtbeGbbhQtWBk
Score

3^/10
behavioral18 behavioral19
- Target
  
  SAMPUninstall.exe
- Size
  
  56KB
- MD5
  
  bffa504cd63305418858b150faa8f408
- SHA1
  
  86886fd2378aa33935cf684f056454859713aed4
- SHA256
  
  d00f8bf2eaa1994b0064d7b14fc987b0aab9b3c440a4177257ee2d3217fe6d3b
- SHA512
  
  6b8958a4ccffce02ba8e4390f66121a02116e2b2ef9c4baa2eea62b8acfe380d0c0dd5e773f83b7062467a34019612d3f8a531e1a4ffcefb769de964cbf02019
- SSDEEP
  
  1536:HLXB65939tY6HBg4sXJOgdLeAyN/dIM6su:HLk395hYXJOceAlMM
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral20 behavioral21
- Target
  
  bass.dll
- Size
  
  90KB
- MD5
  
  8f5b9b73d33e8c99202b5058cb6dce51
- SHA1
  
  102699b1dc7e03c9041115f5e3b178f1dab1a27a
- SHA256
  
  3f04620d6627abe5c3b4747faf26603ab7a006c81b2021ab4689bdd7033bb4cd
- SHA512
  
  89d830d1ed0c55882d1cc77d1a87b193cbffd8b96010d727fad6cd2668ee94c7acfb565ddb1be5b55c8caf9791947b62e8d87fa4896d98124ca2caae0053c9df
- SSDEEP
  
  1536:fq5gk9BPaPT8yWZv6UXq+BpSAaSv5vfwKaGorBWHiauTXJSJ:fq5r9BCPT8yZfKahrsiauTZo
Score

1^/10
behavioral22 behavioral23
- Target
  
  rcon.exe
- Size
  
  36KB
- MD5
  
  3f4821cda1de6d7d10654e5537b4df6e
- SHA1
  
  ac682119ac4dc51d8db82fd4a6a0e1f108b74a94
- SHA256
  
  19f0d6d844f6f14856e3ea88853202b6310edc4726eb0c803710b67f641e596f
- SHA512
  
  0f7f5da6d38a7ad920959363d6edcba3ec9b8645b7ccade0c4590817fbbd7a0415ba492a164c56845a57df643e4d58d83f6f537cc74d55161001704b017a9f7c
- SSDEEP
  
  384:ZYblkmoSCITDXSBkCmleSWLJETJBsE9yzd9LzSjvEgKEyokl7V:Obpo8DXv34JE9W0s9LejvRKRoe7
Score

1^/10
behavioral24 behavioral25
- Target
  
  samp.dll
- Size
  
  1.1MB
- MD5
  
  5ba5f0be7af99dfd03fb39e88a970a2b
- SHA1
  
  cfee81e92701580ff63e62dbb38d4035a05cfbab
- SHA256
  
  b72b5dbe725f81864ca3f78bc7063bda56cc05fc7188af822fa7a754432553a2
- SHA512
  
  a7459e33509f33eb21268d4bd70604953cb5b71555ef217286f848794e71980e0b5541c87d1d935d999fddd79e83e99893d97e9a90b8b570c5daa8fde34288a2
- SSDEEP
  
  24576:hZgAAx6bqT+6QbhmCkh+LPQ5M+5BxX1s/elplhAEZOQ+uMPGP:JjuaP9PQ5MarKWJhsz6P
Score

1^/10
behavioral26 behavioral27
- Target
  
  libEGL.dll
- Size
  
  438KB
- MD5
  
  660a9ae1282e6205fc0a51e64470eb5b
- SHA1
  
  f91a9c9559f51a8f33a552f0145ed9e706909de8
- SHA256
  
  f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85
- SHA512
  
  20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263
- SSDEEP
  
  6144:79h+56bG/eyllh9g1Kajo9wEVzZJAWpf4IBL75+Hjr:79Jbwla1KoAwqf4I4v
Score

1^/10
behavioral28 behavioral29
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  bc45db0195aa369cc3c572e4e9eefc7e
- SHA1
  
  b880ca4933656be52f027028af5ef8a3b7e07e97
- SHA256
  
  a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10
- SHA512
  
  dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f
- SSDEEP
  
  98304:txhV5ahd7dNgHB1g468F4p9+7ULjSLy+W:tDVEhd7dcFE9+kSLx
Score

1^/10
behavioral30 behavioral31
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit-x64.exe
- Size
  
  1.3MB
- MD5
  
  78a23bc6548f7c06051864c8ebfabc59
- SHA1
  
  e33bf8eabdeecae85a5667aeb468e0897b110341
- SHA256
  
  b8dda19cd775798beeca7b4bf6fe2d27580d38d7d8c833ea173f7a1ba529d9cb
- SHA512
  
  4f481b7fecd47d253386da3af093e466be0a787d092edc358d1c3d727a4ac814c9a4aee856931b6823b3bef97e92054645d27bab4d4af9cc6ab555f3383c7e47
- SSDEEP
  
  24576:3EyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnE:3EydbMyuqIQbfMO0
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32