Overview

overview

7

Static

static

3

Loader-2.2.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows11-21h2-x64

1

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

1

Loader-2.2.exe

windows11-21h2-x64

7

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

locales/kn.ps1

windows11-21h2-x64

1

locales/mr.ps1

windows11-21h2-x64

1

locales/sl.ps1

windows11-21h2-x64

1

locales/ur.ps1

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

1

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst....2.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader-2.2.exe

  • Size

    70.8MB

  • Sample

    240316-ffw9wscd3s

  • MD5

    2dd25b848d325718520e316464058594

  • SHA1

    8e53b36539920cc9aeb4ebe6e58848a28f5a201e

  • SHA256

    33e3c9e5a03de76388cc46a259ff6a45cfbf2aa8baee1fd93c7fe020b71abbf8

  • SHA512

    c33d50e9b28709743d2f2fc22ec417b74260cc08bac94c28e6d75a599dba0a5e3f688d2ad0c4975b1f3be94786f8a3686221c5f522a9fda91b1a9ece831d1634

  • SSDEEP

    1572864:IQpHvAnchZB1992ABmyNGFNdsSITfZiv7PbdpWBrEC2B6/u:I6GchZB194AMmGEAjDdpg86m

Score
7/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      Loader-2.2.exe

    • Size

      70.8MB

    • MD5

      2dd25b848d325718520e316464058594

    • SHA1

      8e53b36539920cc9aeb4ebe6e58848a28f5a201e

    • SHA256

      33e3c9e5a03de76388cc46a259ff6a45cfbf2aa8baee1fd93c7fe020b71abbf8

    • SHA512

      c33d50e9b28709743d2f2fc22ec417b74260cc08bac94c28e6d75a599dba0a5e3f688d2ad0c4975b1f3be94786f8a3686221c5f522a9fda91b1a9ece831d1634

    • SSDEEP

      1572864:IQpHvAnchZB1992ABmyNGFNdsSITfZiv7PbdpWBrEC2B6/u:I6GchZB194AMmGEAjDdpg86m

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    1/10
    behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral3

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral4

    • Target

      LICENSES.chromium.html

    • Size

      7.9MB

    • MD5

      0e3e4362f785aff0b9e1852b1064c0f1

    • SHA1

      a42ccb51e72bdcb5bb905a62efaa28857def3a17

    • SHA256

      bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

    • SHA512

      193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2

    • SSDEEP

      24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i

    Score
    1/10
    behavioral5

    • Target

      Loader-2.2.exe

    • Size

      155.8MB

    • MD5

      89ab375c75a56dd7857697a7c90c32c6

    • SHA1

      2f180a4f45d65dd0677842dd5cf45f8710d9cb7a

    • SHA256

      a3d2d9de4a9ddc2710069058aed84ce8281de9db57894c7bace11e118dafda90

    • SHA512

      7e4058074101709fb2aeb33ace68649dea3c6878dd85f41131df59166c46db491b702d087f19866a13acb0e64fac73c0f477091a1a10731f9e2f4d15de62165e

    • SSDEEP

      1572864:oOehMi9HmQapOF/wcuOG/KTlWoqYtUMogmhQXoqAfIgrWAdBb9pTHPe3HdYYGQc1:RZK9PUddCvs

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral6

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      2191e768cc2e19009dad20dc999135a3

    • SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

    • SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    • SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • SSDEEP

      49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

    Score
    1/10
    behavioral7

    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      2a7c224800f0a752db6eaf3ab7cae796

    • SHA1

      b718b4b7ae938a10042bcdb2aec45894e76e21da

    • SHA256

      6d0f59c9e75ca6b16ff63a005045e33e201bff2f9d4900b9256cf2f7032722d5

    • SHA512

      d2301bbbbe3e882d34bdca48a3b9c89ae8457a38000afc9b8b23ec797fa50642316e33c79dbe9f1954bac39f66531d9792c65d02524e444e3b7b7fe4e49cf8db

    • SSDEEP

      49152:AZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqzv:Uofp1Pyi54wnKxqg4INhh9

    Score
    1/10
    behavioral8

    • Target

      libEGL.dll

    • Size

      469KB

    • MD5

      45ef2df5f6aaf1ba9ecddbfa0f07574c

    • SHA1

      0f93c5b9775ad32d342963f4dd27bb0cdaadd793

    • SHA256

      22ba0c9acf55f4fa5df7098b70d020d65619703a282d45b288632f248cd23b4e

    • SHA512

      99423f92eeda8e907d0e2c0a2a7da5a89e64b7b4b4d5f93ee48c91c9f2a0d415377b373fa656386f1fc0d6c8556e57ce2d4001650a47f5f6f4d5ca217d5fadbb

    • SSDEEP

      6144:s4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93Gb3sm:s4itlpAqKqK5Z5U+jBolfnjIyG

    Score
    1/10
    behavioral9

    • Target

      libGLESv2.dll

    • Size

      7.1MB

    • MD5

      0bc536dda0cc8195f58a48b9500e3d48

    • SHA1

      d1fd4ffa994b497ff927c2851660e929f3079aef

    • SHA256

      4e7afc3a650cf414deba33ab4d755f601624a8e24934b43a958eca933d65d8ea

    • SHA512

      372b5e9890eda267097dd92acd407d422c3621452c19720c510c44a3d468779d12d5a3d557c2ca64f0bb86c6766665e2bc100ca465fcf604df2ed950f406a636

    • SSDEEP

      49152:x2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7y:x7RWft4NV+sduHox6gWE5lHoFX

    Score
    1/10
    behavioral10

    • Target

      locales/kn.pak

    • Size

      1023KB

    • MD5

      74f0e9c7c670a981d3651e0d189dfc47

    • SHA1

      a2fd3037311f36aaa348805d57172f9e9b0680c6

    • SHA256

      0c8e0b6a8398d7b9ab9cac634e4a7ce4453540358e79ac6e9c5633efb4182fe9

    • SHA512

      2c555439f7de3902b2b1a940cd43977558c4d9239c449105fc24777952af8de592ba86a7476567d190719c66d38f7a7982c9b94278c0594de1b427dc546f2d89

    • SSDEEP

      6144:3jIXOpf5AEb7XtwKG20PSjNlB2DPVX1EB/lthEVGkcVw27zidmaZXH0r2AxiYRpv:3cHS7XxRPaEjJ2j7q5DPUc+vB+13d

    Score
    1/10
    behavioral11

    • Target

      locales/mr.pak

    • Size

      870KB

    • MD5

      1675668911fd3063e092fe34579c210c

    • SHA1

      d1d09041778599002d07a89848ddd79cf5f4f4db

    • SHA256

      436efbdbce605c23f855644a9ff1b04d9a3eca37de3b18de8c3e589930d54096

    • SHA512

      61c7aabb00700773bb55522e7ae9482d1d97ace936c9bbfeaef3215a976c411a51f41a2d5aa05f2b286b0d112b5616215b9fa3632eaee38b1ec090dfb29391b1

    • SSDEEP

      3072:ryyL/Ti/fQDFJEm1VhkrXspg2GLXFEMUAG3GRa3RQR3Kz/YYxi4noc4AmHwpVuQ4:pTi/fSLIje5DDcJ01V55ipWLYb

    Score
    1/10
    behavioral12

    • Target

      locales/sl.pak

    • Size

      433KB

    • MD5

      1b02b0834b8bbd12a77f7fff09e1d81a

    • SHA1

      1898cfedde55aae307f7578b88cb0bcaf61e1d52

    • SHA256

      b36e1fe2405cc4b9f34587e30da2feadaa6f03124769b02f79333adacaddb49b

    • SHA512

      b1006053ace6f8842e9436c94934b2e7d1b502e3df9ecd1fe59ab39ae35e69e8f0dcff8728aee2c35a3a1eb7a27f0146d6113b4de0632dbab20eb0a37942bc4c

    • SSDEEP

      6144:4O8DqTPKIM7B2zi2i+ennbANjdnPMAm4ocyxPbPDTmAu1pHHGfXjQLO25QlhDc/6:H4qy7B2kZSSl25ytc/1rg/J1i/fzUZqk

    Score
    1/10
    behavioral13

    • Target

      locales/ur.pak

    • Size

      622KB

    • MD5

      8d6fa97205a1d2b371a54144aea453ca

    • SHA1

      11a77318f571d15daf7ad047b06e1ec8a51c8f8c

    • SHA256

      578aef61fc8b5c2e0f3765b1487f8af9f72f6506050d501fec9edcbf93c7a3e4

    • SHA512

      9c8dbf1126b97bca195c801b81afdbd8f68e8f44ebd57c563d63f6c1a3f7fa08b1abc76e25a28d1eb2cd8bc47c9438f23b72063f081f0bce6b8f48bd90a56433

    • SSDEEP

      12288:9lhG4V8PzqSMeyeSD7J/5TZPEHbWC8cQYrUu7co/9NjjFpv/j:9Lz4a5mW2

    Score
    1/10
    behavioral14

    • Target

      resources/elevate.exe

    • Size

      105KB

    • MD5

      792b92c8ad13c46f27c7ced0810694df

    • SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

    • SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    • SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • SSDEEP

      3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

    Score
    1/10
    behavioral15

    • Target

      vk_swiftshader.dll

    • Size

      5.0MB

    • MD5

      516c5b93b1c13af0ad393bff6aa4e259

    • SHA1

      a8823263ee4c2b7ced5aea055e6f4105df09e478

    • SHA256

      2377fd655c1e0b6275f109258f3af70161996f6ccbf8d67bb654d3a9edf6d5b9

    • SHA512

      b976c2373525dd1ac9493d281ec5a1685d1c63b41c44db6f0df10915a6c97a2e041d3f00485aadf7b52695c901d5ab1fe2ffe0caa7aeeae6874065b185d81a22

    • SSDEEP

      49152:Ab03fn3GIdr1DO1N8jvfWSrvOuyEE0+w7rz77gpxbhk0H4t38mvttDpSHUoeygs4:d3v3xDvRTGVgt38mvt1pSH0adU

    Score
    1/10
    behavioral16

    • Target

      vulkan-1.dll

    • Size

      910KB

    • MD5

      d1f1609b93993a1c74872faf7694b01d

    • SHA1

      4237815549b77f3509ee99f8ed6a86de6c15aa20

    • SHA256

      d0615dc92873f5fc92a74cded1e0ec34a702d6a3e671778c841be20da2cd4549

    • SHA512

      cd80b50476c4358e06736789b99c5f8c97f3fa5c7dee85610eed26a5ea42189f6475f97ff00b7d11c15dbe72b9b7734eb01732275a1b510d13663dc775eff81b

    • SSDEEP

      24576:FoHDVVdrfQ09CPKuy0O0Q6Z5W0DYsHA6g3P0zAk7m+:FuVdrI0GKuy066Z5W0DYsHA6g3P0zAk5

    Score
    1/10
    behavioral17

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    behavioral18

    • Target

      $PLUGINSDIR/nsis7z.dll

    • Size

      424KB

    • MD5

      80e44ce4895304c6a3a831310fbf8cd0

    • SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

    • SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    • SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • SSDEEP

      6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

    Score
    3/10
    behavioral19

    • Target

      $R0/Uninstall Loader-2.2.exe

    • Size

      135KB

    • MD5

      c69c13f8edf916eb1f7b5e25eb7e9b63

    • SHA1

      59f3a9c63265a9d7290cc80d1f2976b7801e1ba2

    • SHA256

      7224fd9976adbe9ad36a01ae7a9c506be18faa111c375ba116d0cb5385bb0483

    • SHA512

      77d979ea649e58a85b73d9e318822fe04fbc752c8076a56a6b29c22df6b704c809dfcc52c37b16c602b6cb36813c45ede381e2a6a2219e42f217d2211c091a3f

    • SSDEEP

      3072:on77v00hEoDEtauSceAy6lPMMlxaH2tvhOEA1RJCir86SrSrv6Ia3Y:o740ICmySMMlxs2t0EyL+yao

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral20

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral21

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral22

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral23

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    behavioral24

MITRE ATT&CK Enterprise v15

Tasks