84e833237d4f79de14677632567858c73c68fcdafa16df9685f485c6408d19c3

Sharing

Copy URL

Twitter E-mail

General

Target

Launcher (1).exe
Size

82.2MB
Sample

240227-y4c52aae76
MD5

851695031445470fd40a458dc3f10e9c
SHA1

f2537c941b548c1af8f4fba4b9d44722d9ce8aca
SHA256

84e833237d4f79de14677632567858c73c68fcdafa16df9685f485c6408d19c3
SHA512

249e6c75779998bab605b5ce5c98e1b11cf2d6bd0d54fe78f8534201edbdb362798848f70b5a87c51c8e5d9966d50e241acce1bdc8374872f9f9906682bfda9b
SSDEEP

1572864:2/WHHr90/uSkvNsgHIHW+Wh/X7q/Cd/x77ODfIQwTg8AgMIsPv/HGYxJMvW+qeDf:2/8L9EuSkvqHzu7q/CD7cfIQKgHBxiFf

Score

7^/10

Malware Config

Targets

- Target
  
  Launcher (1).exe
- Size
  
  82.2MB
- MD5
  
  851695031445470fd40a458dc3f10e9c
- SHA1
  
  f2537c941b548c1af8f4fba4b9d44722d9ce8aca
- SHA256
  
  84e833237d4f79de14677632567858c73c68fcdafa16df9685f485c6408d19c3
- SHA512
  
  249e6c75779998bab605b5ce5c98e1b11cf2d6bd0d54fe78f8534201edbdb362798848f70b5a87c51c8e5d9966d50e241acce1bdc8374872f9f9906682bfda9b
- SSDEEP
  
  1572864:2/WHHr90/uSkvNsgHIHW+Wh/X7q/Cd/x77ODfIQwTg8AgMIsPv/HGYxJMvW+qeDf:2/8L9EuSkvqHzu7q/CD7cfIQKgHBxiFf
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

1^/10
behavioral7 behavioral8
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral9
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  384713176a162115d30e9af7ee20a5c6
- SHA1
  
  7efd2c9adb08fd4b893cad5613891f2e96e88351
- SHA256
  
  64dbe39b8bced2d4f2ddd727e914f17a385366cac4d4e63118915b2b093d90c9
- SHA512
  
  2d25176ae9f9d35f82c713e2321e74fbe4e730437a0ae733adc49d85f41c6c47287617f497ea0b414716bd790079d1b4372bd07f51664222276879fcec15af5a
- SSDEEP
  
  49152:N8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFC:tn1H9MDCn6OFMWyBC
Score

1^/10
behavioral10 behavioral11
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  6c5b0b0db75e8c47ab56becc18711074
- SHA1
  
  496fbf7623a6c81b5c7ffa9b24b73281261653ee
- SHA256
  
  f37e1330f5213a7171d8d227300b431dee8ba4f5809c86dd88240ce440724d0a
- SHA512
  
  cd5689cd1f72ef0e7f92515217290179885ae9a47186351347cb93354c028eba1c543920cf51c0f83ae16543c1dffd7f7cfae05d6883c1bf40924af08fed89ed
- SSDEEP
  
  6144:uI9l960ewE3X883ZrzMkBmi12EvUGsADlIgHc:uClY0WM8JrzMIKOD1
Score

1^/10
behavioral12 behavioral13
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  6e5af27d35dfd23416fe47db329b9109
- SHA1
  
  9c4a922b7ff3c8204ade0903ec029a1a3d274fc1
- SHA256
  
  11c02af9eb233ffd13c8ffae49aea486c97d1f631f560822bbd129a6e14107b9
- SHA512
  
  a0c742b8a75f5ee349924f7463e64164fbdc05ce520fb3e99694796be6e9d9799a4d2dc60c7c2580bcaaeee553c920a3c767a624d2269a683dc05611a3623d46
- SSDEEP
  
  98304:dAgpTkR1+f1SlkWW6yAKwCD2x9Stm5H5wXVnJ:O9nSYxCdcKn
Score

1^/10
behavioral14 behavioral15
- Target
  
  locales/de.pak
- Size
  
  477KB
- MD5
  
  7ccdc41a3dbdf89058d71629225664ae
- SHA1
  
  e15c35b18685d9573349ff4247733b5f5ada8717
- SHA256
  
  163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9
- SHA512
  
  13b20b0db02a0a7480c56c79304ef594353507e1a30da0130b73aa8e9ec7636f306315a6f40729b10dc725f936642d2e2b282ed3040a079a6f25a7f9f7f1ae28
- SSDEEP
  
  6144:hHb3YfHLHsf63K7UpTzighla/nxDUBEmw3Am0o268dz5qRwT1MROI+ChF:yzY63K7UpCgvaPhf0p5q9+ChF
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral18 behavioral19
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  413700033c7a02a0fb21eb0b57e3d87e
- SHA1
  
  77961132c3450418f6f8601e9210420602039cf0
- SHA256
  
  2a711ae49eea54fd2d7e213af228ffaf57f5a76d8c8d9c225f4b055198f47bc8
- SHA512
  
  9341b8395d4a689b215246171f05f5a0ef7c02b9d1716bd43ed5ed1b8047042f29be4f7a11145dae40afebcd1b28b27519dcaf113398c181082d3e4e6b45d92d
- SSDEEP
  
  49152:A6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKY8:ANZFjAgpOz2VeCCAkEvkCvGZo9z
Score

1^/10
behavioral20 behavioral21
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  a820f574b55fc3dd5a7a5fae89e90bf9
- SHA1
  
  c0c81463a64b3f98a6a3c8810f4dbb42ae284f9f
- SHA256
  
  52ba3ca2a03fd547e0ca45d8338265f4c5898a7c0e941dc90c80e9e5e9fbcebf
- SHA512
  
  4f0f65141a8941f66c452389d75dc719a27ea213502abe05353d4d8dc1a494ae67ea38af19bef4dc4ae6c97427043c175d98af8b0247a8fc2337a9492c75ddcd
- SSDEEP
  
  24576:9V9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7GG3:Rt2zNLnxA1+66Z5WoDYsHs6g3P0zAk7Z
Score

1^/10
behavioral22 behavioral23
- Target
  
  win32.exe
- Size
  
  158.3MB
- MD5
  
  1bfac951ec51705d7d655642bb12793c
- SHA1
  
  d60338af94acec43890bfe693e5324992b1b84e6
- SHA256
  
  9b65785384c131ff3b1665bd405a0a9066326b30e71d16b1c57615a2596b69cc
- SHA512
  
  e0a9857102f7487651a68d5c087f8a2c4b5f1dd9f4302bb96eaa7a7b318083f732b15603c5118cfb385d84e00725a20e0246719ac2abc6dbda3f9230a7c3b5a1
- SSDEEP
  
  1572864:ydPcKUXsjgWcPlYufjnCtdTG1pTkvqN3PN5g9qPKFTQyun+9qS/ALy/s88IcgDFf:l1os5I8Ax
Score

7^/10
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral24 behavioral25
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral26 behavioral27

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27