Overview

overview

7

Static

static

3

geode-inst...in.exe

windows7-x64

7

geode-inst...in.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Geode.dll

windows7-x64

1

Geode.dll

windows10-2004-x64

1

GeodeUninstaller.exe

windows7-x64

7

GeodeUninstaller.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

GeodeUpdater.exe

windows7-x64

1

GeodeUpdater.exe

windows10-2004-x64

1

VC_redist.x86.exe

windows7-x64

4

VC_redist.x86.exe

windows10-2004-x64

4

XInput9_1_0.dll

windows7-x64

1

XInput9_1_0.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    geode-installer-v2.0.0-beta.23-win.exe

  • Size

    25.7MB

  • Sample

    240331-bd5q2aah2x

  • MD5

    4d54a270825b2ff973bda4be5e47a8ae

  • SHA1

    db6e7790c2a7f0ec48a86a3a3e63758c92c7b197

  • SHA256

    55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

  • SHA512

    e12a7907a355b2fcad259c3de2ea2197c5a48373c9f00458661923fb3427d51e546e2ce85c11c361f9b97fa272f0f12fb6ea73fc0f4db07925f7424c2f193131

  • SSDEEP

    786432:usDruLYyGKwaj1Bq2vFRDDmAntXB7Ep+zJfKcf2zuP9W:uiuMyjwafTLDaAntXB7E4zH289W

Score
7/10
discovery

Malware Config

Targets

    • Target

      geode-installer-v2.0.0-beta.23-win.exe

    • Size

      25.7MB

    • MD5

      4d54a270825b2ff973bda4be5e47a8ae

    • SHA1

      db6e7790c2a7f0ec48a86a3a3e63758c92c7b197

    • SHA256

      55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

    • SHA512

      e12a7907a355b2fcad259c3de2ea2197c5a48373c9f00458661923fb3427d51e546e2ce85c11c361f9b97fa272f0f12fb6ea73fc0f4db07925f7424c2f193131

    • SSDEEP

      786432:usDruLYyGKwaj1Bq2vFRDDmAntXB7Ep+zJfKcf2zuP9W:uiuMyjwafTLDaAntXB7E4zH289W

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral7behavioral8

    • Target

      Geode.dll

    • Size

      7.5MB

    • MD5

      e5ce38e49a3e32be6e04afa0ee5aa9a6

    • SHA1

      271f7f35264c68ccdb29a69e67f044fbeb0f1c2d

    • SHA256

      880ad028b514d58003a916b7eca71c36a2cd8cd87c5e917319ddd74670c5d4d1

    • SHA512

      a40a0c1a64591a3a4aa051fca722913ea922239b16f0745816e159adec4add1f6b58dd7188576d386b5a19aa99b751429b80cd6e8034959f9e312d63b0d54433

    • SSDEEP

      49152:qJMDMcG9YiqnQRCkuR+KATaUGnjlmpdXdIO7RAJv5pAQ0HLPTNqdzO7+1MctuvZQ:b69enQRMwXfRAJvN0rpqdzO7+

    Score
    1/10
    behavioral10behavioral9

    • Target

      GeodeUninstaller.exe

    • Size

      84KB

    • MD5

      5b1cb33d4e7e5bb1ab03688ae64e79ea

    • SHA1

      f405e17393431881ca8864a4316d9cc55c17c36b

    • SHA256

      b7402aa7d2a9863e9c93d4fff4816b8a9e54f331d4a3124841618787a9fbea10

    • SHA512

      31d22dd87f84315ace0bbd02a0ea685d548d6306c1bdabcb7588e3808fb045af99795647a5ea3a9b5a9fbed9d89601721dd09bafdc00e8651f982019b26f79a6

    • SSDEEP

      1536:UferrLkSRoe8C4UZsys0Dh1duX6e4RwpBBiBX7IS0hyv4uL7010n6BBFV:Ufi3k+oWDBDh1dunhpDiuhGN70+n6XP

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral17behavioral18

    • Target

      GeodeUpdater.exe

    • Size

      70KB

    • MD5

      ebc79cac0d135c7ce980a734bab9a1e2

    • SHA1

      779251e91e98d0c230f155f8f910bbe4651bc980

    • SHA256

      44d88b9a534b8a439c31a9f2588cfd4e7081eaafc8d4cd0cda51acfba8bec2d1

    • SHA512

      007e6d795bcbee12cf56ef5b73230f9c12004f36d838e313032d36bdcc3706a0f39286abb4d51be5baf509231291e771ee78fda26152904025c7d48ade963b1a

    • SSDEEP

      1536:BQCghUldOxWRnHrXJS/WbVn1JSSZRNASzoVwpyT8Af:BQCghUldOxWRnHrXJSu5n1PZi0ygA

    Score
    1/10
    behavioral19behavioral20

    • Target

      VC_redist.x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral21behavioral22

    • Target

      XInput9_1_0.dll

    • Size

      11KB

    • MD5

      830e56208ade5317e5533599f54d05da

    • SHA1

      fd4d925983d8193f5509931f9c8bcbbe411bee80

    • SHA256

      4fd284d19300d6250e736585418bfbcffc06f0bb7c2af73a24818a9131a558e2

    • SHA512

      676b918b73693c2d6569c68ec85617f0a5195ea46eefb6d8a8b948dbc16daf8f03207ea68c0104fa685291bccd17c5d5379d1dcbff23fc1095f9d31a2d829e41

    • SSDEEP

      192:cQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyXaCwmPgbDLTGc:y/SspI2WgHJZlj/Xa/tvi

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks