6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Sharing

Copy URL Twitter E-mail

General

Target
Feather Launcher Setup 1.5.9.exe
Size 104.0MB
Sample240213-w2b4vaeh8y
SHA256 6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
MD5 50cf11684fc7dd4030f36f36f2bda97e
SHA1 4795a86361032d110cb22ffb71711dd91f678cd8
SHA512 f79e88c30f058de8e209837b20674867cdc2bf536b2496a50906abd823195f59df5af07beb77526680a6b5064235491b591b1696b5590a0e1dd947382148e6f2
SSDEEP 3145728:7KQEzgzrCBz+GBTRJmgm0IRoFO7Ahhq60XYJMP2ZA:Dw3zlggmtn7Ahh9mxeA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  Feather Launcher Setup 1.5.9.exe
- Size 104.0MB
- SHA256 6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7
- MD5 50cf11684fc7dd4030f36f36f2bda97e
- SHA1 4795a86361032d110cb22ffb71711dd91f678cd8
- SHA512 f79e88c30f058de8e209837b20674867cdc2bf536b2496a50906abd823195f59df5af07beb77526680a6b5064235491b591b1696b5590a0e1dd947382148e6f2
- SSDEEP 3145728:7KQEzgzrCBz+GBTRJmgm0IRoFO7Ahhq60XYJMP2ZA:Dw3zlggmtn7Ahh9mxeA
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/VC_redist.x64.exe
- Size 24.1MB
- SHA256 5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
- MD5 0c86174ca06d892881301203cdf2c32d
- SHA1 2b7462bb7732725f011a085349d6d206eed40048
- SHA512 16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
- SSDEEP 786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral11 behavioral12
- Target
  Feather Launcher.exe
- Size 145.0MB
- SHA256 cddcf8a2008fdf3c7bfe8337da7e2345ec72104e60fcc0ce392752cd35839430
- MD5 2e2bd5dfcdd123064c48a7920c62560d
- SHA1 86e043e69cc6fa9930dcca5f00e1ae5e66735fe5
- SHA512 3336da9b2ac8893abf1a02e27ab8e63718c123db8078f9fcad507030dc85807d07941004045cdfb473830efaf3c94acb9b6be075d8932be7220b65dcfe506a58
- SSDEEP 3145728:qFJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVl+:qFF+MnHejtWPrMYQWXPQdP57obOO4C6u
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  LICENSES.chromium.html
- Size 6.3MB
- SHA256 ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c
- MD5 997768ae7eb8c036425bed10f766e823
- SHA1 2ec99026b977f6603a8a7890bc05594a9a4f13a1
- SHA512 f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639
- SSDEEP 24576:nP9t5W7WSLzrj41T4mfA6c606q6C6eBcHKcaRpG:gFO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99
- MD5 68ea02ddbfdd0aa3a694789ee6d95bc2
- SHA1 326354fda27d5de1a7bf23b440c6eeb889c7c00d
- SHA512 5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e
- SSDEEP 49152:qcDHp0Z63RFIEr1OJbJFk1rb1kjKxt0MWH+4WUA8ZQcyTfQV0U5okJO6V8mK9eoP:DDHeimbJKRkQMdZryTfQV0U5okJzKt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  libEGL.dll
- Size 458KB
- SHA256 498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36
- MD5 655672c205e37b079c34a4427118479b
- SHA1 e1d595a25e76f2f1be50f0ac3046e82462790d69
- SHA512 a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92
- SSDEEP 12288:aPwG/ja/jvtG2OQ7Aw1qiQhy/Dq1ug3dk:az/QOQ7Aty/Okkdk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  libGLESv2.dll
- Size 7.1MB
- SHA256 2404be88c798b43499ab7466e2b04bd58510f0d3fa59049aba6ffb932b65c977
- MD5 eb2b911d33f5ba82109a0d5608c28334
- SHA1 fbc578fbcfc88a132438b38e97bb87c16a9f698f
- SHA512 19becd2003702813898893f7b1fcd1db179a76fbd201fe34471254b75ba5e98af262922adafe5ef0672302cdf4c0b1e2f8910fd2e51ded0f3c4d6c5a43de489e
- SSDEEP 49152:Nk6rcYCLRRdx7IXvR7vjyhUpSOIpgRcbSIXv9RPKSNtc1OAE3tg5qHqwfuXBMwrE:ZYjEXvRhpS7X7T90VSJAxtLNSg1Sd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/native/cleanup.feather
- Size 989KB
- SHA256 4fcdb7229bfcaa4b158d0a2b4092e76d8145a1e82fa432c99a7d5ad11eb84e9e
- MD5 7c2dc9165c530f4888ac63233c040560
- SHA1 41f5048d8365df3fd35c744ceb49bb5ff0e63edb
- SHA512 a6dcc746353c736d848ae3eed110a519e3db52195f4f02193d322220948073964e53e4d082cf3a07765c48018f357153257cd04d5f5f3d05bb44dfd400b2932b
- SSDEEP 12288:R0dD9oALKpJk9ptMn+lYv58SwpJXkvprbCBTmPxVZIVKayDSYd/:R4xJiJkicM8Swp9yrbCBTmP+zOrd/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  resources/elevate.exe
- Size 127KB
- SHA256 c96cb4fc5f3edc88f00c6e50a8818ee6312c56a12d61ce3fd65c307b3ff1cce9
- MD5 e983313d1b03df6a0ac260a45ac849f3
- SHA1 25183947c4a13059f2b78d1be12d00685f16c82b
- SHA512 4d34fd0cc870677a3e0d70cefcaa8003c3da6ac18b3ef534b3689fe5ff78b3f8a52ff115cbccd1ad45ade9a6a9aa3ae205c1857a23406b6c452274311da0c14f
- SSDEEP 3072:StbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYTGAT94:ePrwRhte1XsE1lYTxT94
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  vk_swiftshader.dll
- Size 4.6MB
- SHA256 070c9bb970f13a47e3246fbeadd4d2d3916273e1ae3db2059d806691bfeaf6d8
- MD5 17bb7a2a7cd8ccd96ed19753cfc75bec
- SHA1 7c996eaa179fd472a572a0efb3e243a81b283977
- SHA512 80ff7ba1b32e3de374e8637852b96c12882a5f7d32651ff0e1c2cb97898a44aee46a569a42b073a4e368f364f0daae2e86eca36068fe6794eb5ba55cd3ca5ee4
- SSDEEP 49152:eg0lNhuGaO/dRxQGQ+mEjWIyKGTJtE+M5q0yN769reA3Em0PNX4WbUEwxWvbG5wW:jm/j7sw7kQtlVdQQog
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28 behavioral29
- Target
  vulkan-1.dll
- Size 849KB
- SHA256 ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea
- MD5 58871cf606db440509b56a3f764e72e3
- SHA1 312e810cfcfb663b0da00eac3b87294c0b035cfa
- SHA512 07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4
- SSDEEP 12288:EaVRm5GYB4ad1TQxKhZasTkTDimWLr4Tg+v+U8Amor8F:Eaa5GqLd1T6aDk6LrSL2l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32