Overview

overview

7

Static

static

3

geode-inst...in.exe

windows11-21h2-x64

7

geode-inst...in.exe

ubuntu-20.04-amd64

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...LL.dll

ubuntu-20.04-amd64

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

ubuntu-20.04-amd64

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

ubuntu-20.04-amd64

Geode.dll

windows11-21h2-x64

1

Geode.dll

ubuntu-20.04-amd64

GeodeUninstaller.exe

windows11-21h2-x64

7

GeodeUninstaller.exe

ubuntu-20.04-amd64

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...LL.dll

ubuntu-20.04-amd64

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

ubuntu-20.04-amd64

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

ubuntu-20.04-amd64

GeodeUpdater.exe

windows11-21h2-x64

1

GeodeUpdater.exe

ubuntu-20.04-amd64

VC_redist.x86.exe

windows11-21h2-x64

4

VC_redist.x86.exe

ubuntu-20.04-amd64

XInput9_1_0.dll

windows11-21h2-x64

1

XInput9_1_0.dll

ubuntu-20.04-amd64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    geode-installer-v2.0.0-beta.20-win.exe

  • Size

    26.0MB

  • Sample

    240322-grzd3abe4v

  • MD5

    96129f6af37f48553f7bd8378ee3e579

  • SHA1

    c4b30e2e9fa614a491b6293df18c784bf0facf4a

  • SHA256

    b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910

  • SHA512

    d02df430180d577c0c0990d0baf5bbe47ed9909b6b74bc26c625aa6020e65afab4c56f5be368bed0b12fe615d5f757deca772a5b7b44f1e98fa120f09cbd2805

  • SSDEEP

    786432:uIOiZDMdNxWgZNKQO1ntXB7Ep+zJfKcf2zuP9Y:uIOiGxWg6x1ntXB7E4zH289Y

Score
7/10
discoverylinux

Malware Config

Targets

    • Target

      geode-installer-v2.0.0-beta.20-win.exe

    • Size

      26.0MB

    • MD5

      96129f6af37f48553f7bd8378ee3e579

    • SHA1

      c4b30e2e9fa614a491b6293df18c784bf0facf4a

    • SHA256

      b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910

    • SHA512

      d02df430180d577c0c0990d0baf5bbe47ed9909b6b74bc26c625aa6020e65afab4c56f5be368bed0b12fe615d5f757deca772a5b7b44f1e98fa120f09cbd2805

    • SSDEEP

      786432:uIOiZDMdNxWgZNKQO1ntXB7Ep+zJfKcf2zuP9Y:uIOiGxWg6x1ntXB7E4zH289Y

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral7behavioral8

    • Target

      Geode.dll

    • Size

      6.7MB

    • MD5

      3df3962ef7974ef65e4ebb87aaf31ba7

    • SHA1

      8b3100cc6b7a1a5af347e1ccf3e0f0f0a283065d

    • SHA256

      a0c25fec042a599201d591bc9c61a14566e760ae4b54c82ccf3c671881e1a219

    • SHA512

      d2df79d60775b62ad107dacb27418711b6e9e4d1cb3e217f5f3dbe986e685eb73817aba6bd92ac514441492b628161c69452f75272871d5f747a5b8c035b9966

    • SSDEEP

      49152:avD8JWK3Cg5i8dLvafx5JBScwiGCFkaAguUvMiQ02PlC0Jdt3Pvvcs64WnJ:Vtd5tQx5J1wieguU60OlLdt

    Score
    1/10
    behavioral10behavioral9

    • Target

      GeodeUninstaller.exe

    • Size

      84KB

    • MD5

      0c0eccfe42409d4920761b9e97024a19

    • SHA1

      6697aff9d1d2194ac70ff0c1b15c367eb717fcb1

    • SHA256

      1d5cb5664ce800d33fa62ef0c3fd8f8c2f5aac11fb6d47d430ec8620a1b4fef5

    • SHA512

      7fa5ce5e5881fe191a567adbff6954b375638c230dd50ddc41ef89c778b4c403ed6322a108743432f0733852c1710255f330ce0892d0c7462c3dd95e2ca3b0ba

    • SSDEEP

      1536:UferrLkSRoe8C4UZsys0Dh1du+6se96eiuWdJX7IS0hyv4uL7010n6BBFF:Ufi3k+oWDBDh1duEq6e7jhGN70+n6XH

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral17behavioral18

    • Target

      GeodeUpdater.exe

    • Size

      70KB

    • MD5

      23534220ee3fb4cc4a06c912af71c5ee

    • SHA1

      1da02d75f3b4c2c849df5b89c361417e130c1ecc

    • SHA256

      5ba8ea87edd09b0da04d8d85723ffdf59234e0f5b1578067523b1d373a0e02b0

    • SHA512

      5833cd90194419ba066d882a3558295bbec62fbbccf41a195ce7594c3617d16dfb553679de032fda82e52b78de4286a3951db0f584bb6fb73ee22c020d6752df

    • SSDEEP

      1536:hhiuCGVBzyWfnydf530/GkVCtgJ2UZ2D2PIOVofM:hhiuCGrzyWfny3qGkHH4iQOVo

    Score
    1/10
    behavioral19behavioral20

    • Target

      VC_redist.x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral21behavioral22

    • Target

      XInput9_1_0.dll

    • Size

      11KB

    • MD5

      d61fd9bf10f59713082cfc9a3accbf87

    • SHA1

      d36a0129c846be9bd2a79af82a5a9af199f84ed8

    • SHA256

      0222e64dc51dc14095e453b46b485834b0c81ae8ced850e7e7b52acf11bb723e

    • SHA512

      595e73710bb567fd8be0ac130aac6334ae34bddca3e39c34322c7390947152d15a8717d30a6e923c6d48390312f42501f29436d6c73be59ed086d26362921c3d

    • SSDEEP

      192:TQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyKaCwmPgbDLTGc:f/SspI2WgHJZlj/Ka/tvi

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks