Overview

overview

10

Static

static

3

Mauqes.exe

windows7-x64

7

Mauqes.exe

windows10-2004-x64

10

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

azkzkzz.exe

windows7-x64

1

azkzkzz.exe

windows10-2004-x64

10

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...dex.js

windows7-x64

1

resources/...dex.js

windows10-2004-x64

1

resources/....2.bat

windows7-x64

7

resources/....2.bat

windows10-2004-x64

7

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows7-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mauqes.exe

  • Size

    81.5MB

  • Sample

    240321-ycz6gsab2x

  • MD5

    9a7871e4a4d97bd0843c03413d92fd65

  • SHA1

    80cba1b157a43b9c9fd3fe500f2f8b3acf89a023

  • SHA256

    8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506

  • SHA512

    4ed36eb531c98e4bb4137b5d94b24c8e5804228c614d59147c9d0d28c2f0398b0a08a757fd873621a01e3e74ba30c9bae6c36202e480e5bb4280793b2c4efeaa

  • SSDEEP

    1572864:Yqu78D7epWriSNcfEXk+R8W7Vb8Rfw9QbsGQJB9pepBifT8:Yqf748heiR8KVbufw9Y024T8

Score
10/10
epsilonpersistencespywarestealer

Malware Config

Targets

    • Target

      Mauqes.exe

    • Size

      81.5MB

    • MD5

      9a7871e4a4d97bd0843c03413d92fd65

    • SHA1

      80cba1b157a43b9c9fd3fe500f2f8b3acf89a023

    • SHA256

      8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506

    • SHA512

      4ed36eb531c98e4bb4137b5d94b24c8e5804228c614d59147c9d0d28c2f0398b0a08a757fd873621a01e3e74ba30c9bae6c36202e480e5bb4280793b2c4efeaa

    • SSDEEP

      1572864:Yqu78D7epWriSNcfEXk+R8W7Vb8Rfw9QbsGQJB9pepBifT8:Yqf748heiR8KVbufw9Y024T8

    Score
    10/10
    epsilonpersistencespywarestealer

    • Epsilon Stealer

      Information stealer.

      stealerepsilon

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral5behavioral6

    • Target

      LICENSES.chromium.html

    • Size

      8.7MB

    • MD5

      bd0ced1bc275f592b03bafac4b301a93

    • SHA1

      68776b7d9139588c71fbc51fe15243c9835acb67

    • SHA256

      ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

    • SHA512

      5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa

    • SSDEEP

      24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k

    Score
    1/10
    behavioral7behavioral8

    • Target

      azkzkzz.exe

    • Size

      168.4MB

    • MD5

      5417c504368499446bdec5db1fc32084

    • SHA1

      06f065023d2c7feb3b0d06165e71e90e5bb6f3f1

    • SHA256

      a04e61c7d07593d8cd0981f1a209790df34a06ce2f6b8b1c3056da501a08734c

    • SHA512

      ebf0ff91a80c5658b361a08511df95ae4356cf34d58721473c534cee889e2875687ffd5109b9b6a6d8932c1b7ff42ba2f3eaf1365b6d75036f2f3c9a21cb04bd

    • SSDEEP

      1572864:OFMGWm9AKuVLWFivYPZ9eNo6pIaIPbDjK14DTbGWeUVXIHzzx9dbF5Zwa80aSesY:BGFWZoNaKDTopXz

    Score
    10/10
    epsilonpersistencespywarestealer

    • Epsilon Stealer

      Information stealer.

      stealerepsilon

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral10behavioral9

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      2191e768cc2e19009dad20dc999135a3

    • SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

    • SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    • SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • SSDEEP

      49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

    Score
    1/10
    behavioral11

    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      855d27d5735c1afd26ff53a7f1bb93eb

    • SHA1

      fc4d2c2f13022bedbdee3eb073961587360bb6ca

    • SHA256

      a32800cbf98c84f2da9dcfea2fe8bdcfaaeef07c4eb81469945a992f83bb339c

    • SHA512

      d6df90c3dc66f9dc9d8f7549d8385c0853a398b6dde5fecfbeb2396725f4c4aab50021b39fdb09ab6f553483e9a2bc985a3d4cce33de4c3f3958a86430cccb69

    • SSDEEP

      49152:k9T1onpO0KVy2xq6To8i4BZy7+niuoen6yfzv9x0WFJDI:cpKNMo8rBYinp/FFJM

    Score
    1/10
    behavioral12behavioral13

    • Target

      libEGL.dll

    • Size

      468KB

    • MD5

      5667c348e845c446fb56d7f9d4f11019

    • SHA1

      f02f09799a54ec90371370deac68d36499be45dc

    • SHA256

      72126255176dca2000061657efa0a8e91a9658d1724769b9260093116e131c33

    • SHA512

      daf716e9af5976772e0bf7f33bcbcf347f64de8fc9787f568c1478a464d9f4603f92f3e41242782b07cb5503fffd78bc2e25f040cb932a52614e46a8e92bd2f6

    • SSDEEP

      3072:+Jk+JyNnPUXhbZ/+a1KYsjNDsrJg3qkrzxwbP6wvEMrwrD7Qy/x6TYtaoB+YEB0l:gbTcZ6+lOP9rmD7QMYYtaFy951wj5ye

    Score
    1/10
    behavioral14behavioral15

    • Target

      libGLESv2.dll

    • Size

      7.3MB

    • MD5

      eaedf6de749ef1230197ce1ac0455f0e

    • SHA1

      ba737231f09676278cdeb7840aab1df1ea76c57b

    • SHA256

      8dae6f25ad4fcbbb7eb617ac02fac48c7f0bea7f75c630ea02882cf4fb469a25

    • SHA512

      3417438c516a51e1e04a82c4f145d881c2f2dfb90428656c9aaea80b3b46fa3e4c536b320bc6b137186e200603a4aaa250bd21e0f117b3a02f224cbf20d3a2cc

    • SSDEEP

      98304:3FIH74F3mX+rUNnIdIXoqxWPlXm368Eb:3Cu3LrU/xWPpC68

    Score
    1/10
    behavioral16behavioral17

    • Target

      resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js

    • Size

      3KB

    • MD5

      d226502c9bf2ae0a7f029bd7930be88e

    • SHA1

      6be773fb30c7693b338f7c911b253e4f430c2f9b

    • SHA256

      77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f

    • SHA512

      93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e

    Score
    1/10
    behavioral18behavioral19

    • Target

      resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat

    • Size

      13KB

    • MD5

      da0f40d84d72ae3e9324ad9a040a2e58

    • SHA1

      4ca7f6f90fb67dce8470b67010aa19aa0fd6253f

    • SHA256

      818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b

    • SHA512

      30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

    • SSDEEP

      384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx

    Score
    7/10

    • Executes dropped EXE

    behavioral20behavioral21

    • Target

      resources/elevate.exe

    • Size

      105KB

    • MD5

      792b92c8ad13c46f27c7ced0810694df

    • SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

    • SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    • SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • SSDEEP

      3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

    Score
    1/10
    behavioral22behavioral23

    • Target

      vk_swiftshader.dll

    • Size

      5.1MB

    • MD5

      a209cc01921c3cceebf40fd2ca3aa1eb

    • SHA1

      7c6a483cd79642fc76ecd695f2bcbcd32034f11d

    • SHA256

      d60bf3062d47378d169aea2f7e6666a099d116e55305ae4f3a494f969b7d3d4b

    • SHA512

      276e8856ad362a6836c021f712df9668c1b0eaeb0ed4ba003b5aab5c37cb7427f6cbdcb51fbe657eeb3af276839a3f622a6499dc8b3a62cde82890eefca5e300

    • SSDEEP

      49152:KL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:a1w7weOqiFIYBgTE

    Score
    1/10
    behavioral24behavioral25

    • Target

      vulkan-1.dll

    • Size

      932KB

    • MD5

      707003e3cc124a443deaefc927523bef

    • SHA1

      f73ed8c9dda53e7822316a525e737103534b494b

    • SHA256

      5272e22d7da457a8e8f8b4a4597f9167de348fa36b99a119412e5e7ca186e363

    • SHA512

      ff426f2426adc5bf50d003c93fffe236b7ef6e25020e5b1679f8904e30a8cc21667f86a1154bf32cd119340fddb996dceedc57ed9982a33262160faaeac98b9e

    • SSDEEP

      24576:YkMYSDIukxvnwhdzY96Z5WiDYsH56g3P0zAk7lE1:Yku0fwhC96Z5WiDYsH56g3P0zAk7l

    Score
    1/10
    behavioral26behavioral27

    • Target

      $PLUGINSDIR/nsis7z.dll

    • Size

      424KB

    • MD5

      80e44ce4895304c6a3a831310fbf8cd0

    • SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

    • SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    • SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • SSDEEP

      6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

    Score
    3/10
    behavioral28behavioral29

MITRE ATT&CK Enterprise v15

Tasks