6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Sharing

Copy URL

Twitter E-mail

General

Target

Feather Launcher Setup 1.5.9.exe
Size

104.0MB
Sample

240213-w2b4vaeh8y
MD5

50cf11684fc7dd4030f36f36f2bda97e
SHA1

4795a86361032d110cb22ffb71711dd91f678cd8
SHA256

6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
SHA512

f79e88c30f058de8e209837b20674867cdc2bf536b2496a50906abd823195f59df5af07beb77526680a6b5064235491b591b1696b5590a0e1dd947382148e6f2
SSDEEP

3145728:7KQEzgzrCBz+GBTRJmgm0IRoFO7Ahhq60XYJMP2ZA:Dw3zlggmtn7Ahh9mxeA

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  Feather Launcher Setup 1.5.9.exe
- Size
  
  104.0MB
- MD5
  
  50cf11684fc7dd4030f36f36f2bda97e
- SHA1
  
  4795a86361032d110cb22ffb71711dd91f678cd8
- SHA256
  
  6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
- SHA512
  
  f79e88c30f058de8e209837b20674867cdc2bf536b2496a50906abd823195f59df5af07beb77526680a6b5064235491b591b1696b5590a0e1dd947382148e6f2
- SSDEEP
  
  3145728:7KQEzgzrCBz+GBTRJmgm0IRoFO7Ahhq60XYJMP2ZA:Dw3zlggmtn7Ahh9mxeA
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/VC_redist.x64.exe
- Size
  
  24.1MB
- MD5
  
  0c86174ca06d892881301203cdf2c32d
- SHA1
  
  2b7462bb7732725f011a085349d6d206eed40048
- SHA256
  
  5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
- SHA512
  
  16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
- SSDEEP
  
  786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral11 behavioral12
- Target
  
  Feather Launcher.exe
- Size
  
  145.0MB
- MD5
  
  2e2bd5dfcdd123064c48a7920c62560d
- SHA1
  
  86e043e69cc6fa9930dcca5f00e1ae5e66735fe5
- SHA256
  
  cddcf8a2008fdf3c7bfe8337da7e2345ec72104e60fcc0ce392752cd35839430
- SHA512
  
  3336da9b2ac8893abf1a02e27ab8e63718c123db8078f9fcad507030dc85807d07941004045cdfb473830efaf3c94acb9b6be075d8932be7220b65dcfe506a58
- SSDEEP
  
  3145728:qFJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVl+:qFF+MnHejtWPrMYQWXPQdP57obOO4C6u
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  
  LICENSES.chromium.html
- Size
  
  6.3MB
- MD5
  
  997768ae7eb8c036425bed10f766e823
- SHA1
  
  2ec99026b977f6603a8a7890bc05594a9a4f13a1
- SHA256
  
  ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c
- SHA512
  
  f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639
- SSDEEP
  
  24576:nP9t5W7WSLzrj41T4mfA6c606q6C6eBcHKcaRpG:gFO
Score

1^/10
behavioral15 behavioral16
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  cb9807f6cf55ad799e920b7e0f97df99
- SHA1
  
  bb76012ded5acd103adad49436612d073d159b29
- SHA256
  
  5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- SHA512
  
  f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP
  
  49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
Score

1^/10
behavioral17
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  68ea02ddbfdd0aa3a694789ee6d95bc2
- SHA1
  
  326354fda27d5de1a7bf23b440c6eeb889c7c00d
- SHA256
  
  0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99
- SHA512
  
  5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e
- SSDEEP
  
  49152:qcDHp0Z63RFIEr1OJbJFk1rb1kjKxt0MWH+4WUA8ZQcyTfQV0U5okJO6V8mK9eoP:DDHeimbJKRkQMdZryTfQV0U5okJzKt
Score

1^/10
behavioral18 behavioral19
- Target
  
  libEGL.dll
- Size
  
  458KB
- MD5
  
  655672c205e37b079c34a4427118479b
- SHA1
  
  e1d595a25e76f2f1be50f0ac3046e82462790d69
- SHA256
  
  498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36
- SHA512
  
  a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92
- SSDEEP
  
  12288:aPwG/ja/jvtG2OQ7Aw1qiQhy/Dq1ug3dk:az/QOQ7Aty/Okkdk
Score

1^/10
behavioral20 behavioral21
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  eb2b911d33f5ba82109a0d5608c28334
- SHA1
  
  fbc578fbcfc88a132438b38e97bb87c16a9f698f
- SHA256
  
  2404be88c798b43499ab7466e2b04bd58510f0d3fa59049aba6ffb932b65c977
- SHA512
  
  19becd2003702813898893f7b1fcd1db179a76fbd201fe34471254b75ba5e98af262922adafe5ef0672302cdf4c0b1e2f8910fd2e51ded0f3c4d6c5a43de489e
- SSDEEP
  
  49152:Nk6rcYCLRRdx7IXvR7vjyhUpSOIpgRcbSIXv9RPKSNtc1OAE3tg5qHqwfuXBMwrE:ZYjEXvRhpS7X7T90VSJAxtLNSg1Sd
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/native/cleanup.feather
- Size
  
  989KB
- MD5
  
  7c2dc9165c530f4888ac63233c040560
- SHA1
  
  41f5048d8365df3fd35c744ceb49bb5ff0e63edb
- SHA256
  
  4fcdb7229bfcaa4b158d0a2b4092e76d8145a1e82fa432c99a7d5ad11eb84e9e
- SHA512
  
  a6dcc746353c736d848ae3eed110a519e3db52195f4f02193d322220948073964e53e4d082cf3a07765c48018f357153257cd04d5f5f3d05bb44dfd400b2932b
- SSDEEP
  
  12288:R0dD9oALKpJk9ptMn+lYv58SwpJXkvprbCBTmPxVZIVKayDSYd/:R4xJiJkicM8Swp9yrbCBTmP+zOrd/
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/elevate.exe
- Size
  
  127KB
- MD5
  
  e983313d1b03df6a0ac260a45ac849f3
- SHA1
  
  25183947c4a13059f2b78d1be12d00685f16c82b
- SHA256
  
  c96cb4fc5f3edc88f00c6e50a8818ee6312c56a12d61ce3fd65c307b3ff1cce9
- SHA512
  
  4d34fd0cc870677a3e0d70cefcaa8003c3da6ac18b3ef534b3689fe5ff78b3f8a52ff115cbccd1ad45ade9a6a9aa3ae205c1857a23406b6c452274311da0c14f
- SSDEEP
  
  3072:StbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYTGAT94:ePrwRhte1XsE1lYTxT94
Score

1^/10
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  4.6MB
- MD5
  
  17bb7a2a7cd8ccd96ed19753cfc75bec
- SHA1
  
  7c996eaa179fd472a572a0efb3e243a81b283977
- SHA256
  
  070c9bb970f13a47e3246fbeadd4d2d3916273e1ae3db2059d806691bfeaf6d8
- SHA512
  
  80ff7ba1b32e3de374e8637852b96c12882a5f7d32651ff0e1c2cb97898a44aee46a569a42b073a4e368f364f0daae2e86eca36068fe6794eb5ba55cd3ca5ee4
- SSDEEP
  
  49152:eg0lNhuGaO/dRxQGQ+mEjWIyKGTJtE+M5q0yN769reA3Em0PNX4WbUEwxWvbG5wW:jm/j7sw7kQtlVdQQog
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  849KB
- MD5
  
  58871cf606db440509b56a3f764e72e3
- SHA1
  
  312e810cfcfb663b0da00eac3b87294c0b035cfa
- SHA256
  
  ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea
- SHA512
  
  07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4
- SSDEEP
  
  12288:EaVRm5GYB4ad1TQxKhZasTkTDimWLr4Tg+v+U8Amor8F:Eaa5GqLd1T6aDk6LrSL2l
Score

1^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32