Overview

overview

7

Static

static

3

geode-inst...1).exe

windows7-x64

7

geode-inst...1).exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Geode.dll

windows7-x64

1

Geode.dll

windows10-2004-x64

1

GeodeUninstaller.exe

windows7-x64

7

GeodeUninstaller.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...rd.bmp

windows7-x64

3

$PLUGINSDI...rd.bmp

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

GeodeUpdater.exe

windows7-x64

1

GeodeUpdater.exe

windows10-2004-x64

1

VC_redist.x86.exe

windows7-x64

4

VC_redist.x86.exe

windows10-2004-x64

4

XInput9_1_0.dll

windows7-x64

1

XInput9_1_0.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    geode-installer-v2.0.0-beta.19-win (1).exe

  • Size

    25.8MB

  • Sample

    240213-jj3gvscf6z

  • MD5

    7ed868c7785936197054c0a8ae724311

  • SHA1

    80a2ae57a8b662554f889fecbf4602d9dfbb61c0

  • SHA256

    0de54ccd8146146f7b7b5e92885b919779e2e923b2a12319f258d2e32d7777cd

  • SHA512

    1f744301081c7f0380f91db86e57b60eb6fff9772a5d8b1c94d70736687044507c57bd483fb21fbe597846f2fd13413e1c82f2b59c6d6739b68d8263de62d177

  • SSDEEP

    786432:uBhwPIbvjArPw7d81ntXB7Ep+zJfKcf2zuP9o:utbcM7S1ntXB7E4zH289o

Score
7/10
discovery

Malware Config

Targets

    • Target

      geode-installer-v2.0.0-beta.19-win (1).exe

    • Size

      25.8MB

    • MD5

      7ed868c7785936197054c0a8ae724311

    • SHA1

      80a2ae57a8b662554f889fecbf4602d9dfbb61c0

    • SHA256

      0de54ccd8146146f7b7b5e92885b919779e2e923b2a12319f258d2e32d7777cd

    • SHA512

      1f744301081c7f0380f91db86e57b60eb6fff9772a5d8b1c94d70736687044507c57bd483fb21fbe597846f2fd13413e1c82f2b59c6d6739b68d8263de62d177

    • SSDEEP

      786432:uBhwPIbvjArPw7d81ntXB7Ep+zJfKcf2zuP9o:utbcM7S1ntXB7E4zH289o

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral7behavioral8

    • Target

      Geode.dll

    • Size

      6.7MB

    • MD5

      c2ecf28f8aacafff92a333072d84fa81

    • SHA1

      960262f92de3f0b08b1275fe32d30dbcaa34e8a8

    • SHA256

      32ffa05ff2c7cce0221d216940d6d658cb0bfe0c004dd28b5ea514cc3f5c589a

    • SHA512

      8ce52d2ad704fb89a2fcd6e7cef627aa3ee6eb8c4a5a81640f415b0af578efd223aeb6cdf3d32f7c07499b74fc0fce0825db4d87ae6c1cadce9d6297bbeb9115

    • SSDEEP

      49152:A9rYxHqxRiB2N7d/Lr5VkeMk7xB3e+TZVQ0Uwr6M4kIUXP:A0kiIJrY+3e+g0Uw+M4k

    Score
    1/10
    behavioral10behavioral9

    • Target

      GeodeUninstaller.exe

    • Size

      84KB

    • MD5

      809b4f86611c6e58a89fe85cc63cfd98

    • SHA1

      8ebd1c86a1bcebaaa8968ea2a93b1428111733cb

    • SHA256

      a60700d0f158bdf9b648f13b4b8861fc229612357d6f3ee4413c079a58a35c06

    • SHA512

      7b8f410b0641a6590cdc011c82d2769085645588e526ca6d48fd2799e5162f1076cd42bb533ae44e70bf0f5c009e19d1b97b8ac730ae2a133739a456010654fc

    • SSDEEP

      1536:UferrLkSRoe8C4UZsys0Dh1du+6sfvYiHX7IS0hyv4uL7010n6BBFx:Ufi3k+oWDBDh1duEfvlAhGN70+n6Xr

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/modern-wizard.bmp

    • Size

      201KB

    • MD5

      3c5626cfc549b9a2fc147f84601a68b1

    • SHA1

      df2015ab7aa2eb9943cc5929fb9f7ec14a26b71e

    • SHA256

      4873a57c9b2d697e4f8689ff7a2f785fb836a6289bc377320987b5541856234c

    • SHA512

      b076a7c5350a8fda2f641c052bab4f87a602f313c91a3c0ceab2da45f9753cd89ee97497a5c67552e65a97de1366e69bfc531f6b728224e86314b90b91fd9511

    • SSDEEP

      384:Gx1uncOx0y1ARSzKyHOTEdWTBSYY0Z9XENc5iXbu8naAQHmUn0R/V8jQ1P6g1PKF:0uxVMsf8EbFGHmLRt8jQ1iE95CP

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral17behavioral18

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral19behavioral20

    • Target

      GeodeUpdater.exe

    • Size

      70KB

    • MD5

      1475305b6d89acdf3ccb5b5f6f8f0f18

    • SHA1

      7060c3cefe5d0a15ec9a517f3023984ed66fc762

    • SHA256

      7ceb6a4f1913d229d86029b1bd4bb1be0893b4abd294da3d9795168ae9fcf0ea

    • SHA512

      5afed3e24657c6d134ea1dd05ea6ed06761dea90a887c2b81d11192764901c42fd8757dbc635941bcd657c8193dae60a05aab0f9889a875705ec9e31db6efa3c

    • SSDEEP

      1536:MhiuCGVBzyWfnydf530/GkVCtgJ2UZ2D2uIOVofM:MhiuCGrzyWfny3qGkHH4iBOVo

    Score
    1/10
    behavioral21behavioral22

    • Target

      VC_redist.x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral23behavioral24

    • Target

      XInput9_1_0.dll

    • Size

      11KB

    • MD5

      243096a2af5c60cf433e09044e058a23

    • SHA1

      8ee51584f5195dde325a8772e98d36de1a503dec

    • SHA256

      5800460e6a00db03623d3272c714a4c0881bb0986c8ee2bfb1a9422a2f301f28

    • SHA512

      87b9eba3f833de4f2385adf2b774abd68a65fc3d6b37c6a08f9f13746e722611084b5b1019e0c6a818ff756e00f5b761a798a247aef365e5728ea1a75a6199f0

    • SSDEEP

      192:MQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOylaCwmPgbDLTGc:i/SspI2WgHJZlj/la/tvi

    Score
    1/10
    behavioral25behavioral26

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks