22fea802fc2cff8b7614f2aa6d344f685254781399649e26ecd526f8cc2aba3b

Sharing

Copy URL Twitter E-mail

General

Target
CurseForge - Installer.exe
Size 2.0MB
Sample240303-adf71aba57
SHA256 22fea802fc2cff8b7614f2aa6d344f685254781399649e26ecd526f8cc2aba3b
MD5 4b1f36d729425503ffbbc59e93db1a04
SHA1 c20680f948e64af482a298007c04a2bbe3dab3c3
SHA512 3ecd5f23fdaf0df2b869b35d632d2fd7e5495f7ad7fd40d725ed448181f9274b2efc6d436644ae63011cad264f646685f9947fa7c013090b57143f84660e1aed
SSDEEP 49152:9nG/ix6xE87vxpsrFpIvu7OJGWuMmtcFsuY7iNxCcbR:9Gqx8PN+TIvTBFE7bs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Targets

- Target
  CurseForge - Installer.exe
- Size 2.0MB
- SHA256 22fea802fc2cff8b7614f2aa6d344f685254781399649e26ecd526f8cc2aba3b
- MD5 4b1f36d729425503ffbbc59e93db1a04
- SHA1 c20680f948e64af482a298007c04a2bbe3dab3c3
- SHA512 3ecd5f23fdaf0df2b869b35d632d2fd7e5495f7ad7fd40d725ed448181f9274b2efc6d436644ae63011cad264f646685f9947fa7c013090b57143f84660e1aed
- SSDEEP 49152:9nG/ix6xE87vxpsrFpIvu7OJGWuMmtcFsuY7iNxCcbR:9Gqx8PN+TIvTBFE7bs
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/app/cmp.html
- Size 5KB
- SHA256 6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- MD5 d7b8b31b190e552677589cfd4cbb5d8e
- SHA1 09ffb3c63991d5c932c819393de489268bd3ab88
- SHA512 32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP 48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/app/index.html
- Size 20KB
- SHA256 1f16a65e36c0ee3ec05c4478b12552e89b5ab5cb4863e69823912ee6c429161b
- MD5 2822a4d01b4f0d0299207626845c6ce2
- SHA1 a02ca32d5eb26ea382692acf4973dbc3b230dfd0
- SHA512 9f8fd6a8f8a6c915a3c826b66cdf6d5e49a920c5cff9f71ce09d9f8009177a8a9ace886920575b5d14dfca2d6a0f275851162d6b206aa65cfb75bba94e86571e
- SSDEEP 192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8G:+WNaM8UnbjPkZ9+mppH3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app/js/app.js
- Size 22KB
- SHA256 5b8ab6d562e131159c89eebfc2f665a4a496c8621ef34efcabf7b0a9e1e85b1c
- MD5 715d53e963a034a3721aee76d1c4e8f6
- SHA1 4643837ab7d2249fbda6ed23d025ef738cfa6317
- SHA512 15018563724d17dd22c38daa51c8208286f81e8eea6784ff70f46d81cb3385635b688ccd775734f0e4bfd086189c5db721f2bb76daee4e6d6aad02075e44dee7
- SSDEEP 384:4X+acDQFcljKdZGb9plmt902wjI3A4vnzwF52xxYRifG6wXR3FGHWdMxj8T:0+acDQ+lOdEbdmXH3A4vnzIAnGifG1X9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app/js/block_inputs.js
- Size 789B
- SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- MD5 b5b52c92b90f4283a761cb8a40860c75
- SHA1 7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA512 16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size 324KB
- SHA256 7fbc3a088ec303143109e0c1b2c04f4c5a6e450a2d6f3071fefb66e92f643ea0
- MD5 1de143ca1babd3c02744f478c8c05c5f
- SHA1 ac918b3d2d5f9cbd9e3b3f5e075ce3c96eec16b3
- SHA512 6e419e11f35a3258124127970961907ed8fe0619f618a4c15542ee7f8a01a9f4a7af4d290b634444d21b823ca1afea65f97d5788fff6665d55c2231214edff24
- SSDEEP 3072:LWYyrzt6yrtky1UDtDkNdAOoSPGYTckZtVPuuXheQ:oF6yrKD5kNYYTcIp
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
- Size 90KB
- SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
- MD5 44e3f0db3e4ab6fedc5758c05cf27591
- SHA1 2d408aa1d35661019c95adcc60b78c0727ed25b4
- SHA512 4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
- SSDEEP 1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/app/js/libs/mixpanel.js
- Size 1KB
- SHA256 88872b5b01a8d1dfee124333aba630ceb8535390130833dd2a312c461ac52217
- MD5 344e4265b3d4e1fecfd81c561293edab
- SHA1 51dbcac23b839e64362d11763bbe64538ad80bb8
- SHA512 dcda17cb89861c4cd0be4b7cd93b58283cd1acc3c7a4a2176add3ea6403079c8567bcf88d878aa2e91e96c43b15a7ce668299c3d015c6dc4db5b15cddbe4ea7d
- MD5 SHA1 SHA512
Score

1^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/app/js/models/notifications.js
- Size 5KB
- SHA256 9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32
- MD5 85afdf9897bb1236eff3afa40d15ece6
- SHA1 4362bdd139458eaf4a2dcb34294b43e2d53f4a26
- SHA512 4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c
- SSDEEP 96:sOr8u1s9FvYYdfHsW/GZwzpJGf8mui+U8QrGjqTzoOxOYsdfHsW/GZwzpJGNjINU:sGu9yYl3rNQ8K+JQC+/5Lsl3rNOEYIo
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/app/js/utils/analytics.js
- Size 4KB
- SHA256 c76e5be6cf6513f988e69977a0fedea42fbc700a2e4ef7d136fdf72534ee8519
- MD5 f288498a7ad1ef51bcd3f3272a1809f7
- SHA1 0a7bc52a557ae5cacb5ae7bddebefe0c1aec1ccf
- SHA512 7b2195ce7b6ff8f414ce43ee8cdbfc0660560b6802a2a6271b6a8eefd19d02810c200a51ea1e43269c18f70e5b749e7a515a6db7b8b8ffa7aeeca0a1cd32f057
- SSDEEP 96:LlYkmHqqVHlnZ4JGvt+QP2EvVVko3sO2LCgOb4bgao:AHq1GV+kcRObdb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  $PLUGINSDIR/app/js/utils/commands.js
- Size 12KB
- SHA256 e874c959c7b8e4351d730d263231df7176b5062580a7d3e0a2684001b510f5d7
- MD5 65015f2e2e490f6786abc0560e33e1d0
- SHA1 47b5c2b3b1f9381e4d2b9d1f3d82ba62828ce28e
- SHA512 a4ad579acfa6000fd8074893a6b45df74558c57afd5b957217491784fa25df370c59d9f92ff245abbdf3d26b42114cc22359ef95c4baa322e326c7e210f43edf
- SSDEEP 384:7/W5HB8c36uUvJQ006W8tusv5qEWTwdSW:rFOs5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/app/js/utils/cookies.js
- Size 1KB
- SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- MD5 6c60e675f8c8c68c0174b644d3a63a2a
- SHA1 3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA512 1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size 1KB
- SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- MD5 117e4fdbdb0ecf211c8bd909efd337d1
- SHA1 9f8684d856b7c95bdffb139217dfd89f41373187
- SHA512 f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size 5KB
- SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
- MD5 9c94eb933d8a43dd3825e67a7e30c980
- SHA1 7ec7b16af6f399219209ba5967d377040486a11b
- SHA512 a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5
- SSDEEP 96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6WfwkUlx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6Wme0muXDK0W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  $PLUGINSDIR/app/js/utils/utils.js
- Size 118B
- SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- MD5 a0952ebeab701c05c75710c33d725e7e
- SHA1 1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA512 5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size 5KB
- SHA256 aafb56625ec30b24035baafff7bc20215e8ec7e4be4ea58a90aa5b46bdd14a6e
- MD5 d222c95a2ef0b75ad6c96a3abe20fdc5
- SHA1 641c39f92a169f0ca435ed12d2a4d276eb415642
- SHA512 e9e66abf6d95fc15a6ffe46cf85c3c9d3b80f3884ca4c8cbb5d2b024fa1dcc46a5e2f39041a4a120a8b8b881d07b3d70b18b552332180aa08c4a67577ea6242b
- SSDEEP 96:u6VQTr5TeTGTvf/aaYWCtheobwIbZZuAk5a9k+:u6VQBaiLf/aHWC2oUU7uAW+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32