f3be685607271c36836e02aa2596cd98bbc611c62298f7d1721bfd119404d453

Sharing

Copy URL

Twitter E-mail

General

Target

Era Setup 1.0.71.exe
Size

81.3MB
Sample

240418-xhssxsbh46
MD5

09205ac0c47b54d124acb7c53cf9fcd5
SHA1

f737e8d243ff3691f807a7ff51080a76a39aac8d
SHA256

f3be685607271c36836e02aa2596cd98bbc611c62298f7d1721bfd119404d453
SHA512

37c572928511033b848fae09eb434fd6310e50ba3c5e406161dd8c5432cf2228f6942f46c7db166d35a03436be554feec261cd6108dc35286bf1bd8ef41cbd04
SSDEEP

1572864:i/rkJoOM5/l5BShCqW4poGQ6abFpPAQEJbnqrIlSHmulF1/iTmuuOXfo6I:iDOMBwCj4pTTApPAQEwqAFF07Q1

Score

7^/10

antivm linux

Malware Config

Targets

- Target
  
  Era Setup 1.0.71.exe
- Size
  
  81.3MB
- MD5
  
  09205ac0c47b54d124acb7c53cf9fcd5
- SHA1
  
  f737e8d243ff3691f807a7ff51080a76a39aac8d
- SHA256
  
  f3be685607271c36836e02aa2596cd98bbc611c62298f7d1721bfd119404d453
- SHA512
  
  37c572928511033b848fae09eb434fd6310e50ba3c5e406161dd8c5432cf2228f6942f46c7db166d35a03436be554feec261cd6108dc35286bf1bd8ef41cbd04
- SSDEEP
  
  1572864:i/rkJoOM5/l5BShCqW4poGQ6abFpPAQEJbnqrIlSHmulF1/iTmuuOXfo6I:iDOMBwCj4pTTApPAQEwqAFF07Q1
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/app-64.7z
- Size
  
  80.8MB
- MD5
  
  b42c203fd989d348540219db22ee9e4e
- SHA1
  
  0bda6af4fd70129e9deef0e5a885caca9d4297ea
- SHA256
  
  7fb6bc544c011477a6b4efbd1774db00a9a9654f648cf6edbb90afa839ebd1d3
- SHA512
  
  8fb8094f13134d0e549fc37cc0bdbcb8375e803cac75b19fa196f9739d27642abf1a1a7b181edcd0e286d6acc15eab7e2a69f9929cb964cb2b2a3130fab2f9da
- SSDEEP
  
  1572864:FrkJoOM5/l5BShCqW4poGQ6abFpPAQEJbnqrIlSHmulF1/iTmuuOXfo6/:VOMBwCj4pTTApPAQEwqAFF07Qi
Score

3^/10
behavioral11 behavioral12
- Target
  
  Era.exe
- Size
  
  150.3MB
- MD5
  
  2f88617165e05e48e90f6969e5884227
- SHA1
  
  d796c61b1870a69cbcbdcf1687d23949a3c88b6c
- SHA256
  
  a06cba453802d87bec65b60b02a5f30c359e6d3d9cb0565243b4bcb8e51dd38a
- SHA512
  
  d4bee2d2ee7aa8b429f6f8b30a6d9104a49fadf73b649d28d04f2fe723abd4b79a373f8d1c4da884bbbd23bdcd77b168e768f13ab45d76258644d9e3d0d57965
- SSDEEP
  
  1572864:3oooF3VfXbsePcAR+emDcoIABdUCJZwbsuDu9p+gJqf/H+q0CwpMd1zowkfbODaT:QVwwoMCYoPVma
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral13 behavioral14
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/bin/sentry-cli
- Size
  
  487B
- MD5
  
  b7c89ec5dfb8b15555f32a3bef6c3103
- SHA1
  
  a92048052f5fc0af532cd97ebf82c1a9fbf12342
- SHA256
  
  7c5c97aaee075241bdc4fbc610b356445747e962ac3d986c5016acefd66a6ea0
- SHA512
  
  c47baa0e0896684403760a13cfa6dd5826152ec7ae83f783040d186eaca8af70bc97530bbb22b720d7482a4ad18c3959ab1af8ccfe3689b19a51955e777884e8
Score

7^/10

antivm
- Deletes itself
- Checks CPU configuration
  Checks CPU information which indicate if the system is a virtual machine.
  antivm
- Reads CPU attributes
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/js/helper.js
- Size
  
  6KB
- MD5
  
  c29ad60a23d5406728a51afa4352b4c7
- SHA1
  
  2be817215890f5868717765570ce9f7422735c4e
- SHA256
  
  faa867204c92db252271c9d850962ae1ff5c9448444ca907af483a6c874a6eb0
- SHA512
  
  e1784b8bf7119bf3380b192f1597cb3179425ff7ab347b144011fd17b62794760e6e092a0a1dae99302eb6c333f1638440df4e4e0eaf64f26d4f3cc46a74d04a
- SSDEEP
  
  192:WSqkCoOycfhxPBRw/uL2FqRxJRLVeUdrga:WSbCoOycfhJBR+qjRx/VeQMa
Score

1^/10
behavioral19 behavioral20
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/js/index.js
- Size
  
  1KB
- MD5
  
  50c3a734036b84685a15d56217207d67
- SHA1
  
  1893de2684072a3a2961337fa9a9b45a52c52c0a
- SHA256
  
  171990f108cd5582f83432c1569f2c3e1aebfbfb159599f4ff2ab693c20a8f78
- SHA512
  
  3aa037d12cee7cbf51826fb3e2aa87b4543dd62f5ff5f2f8915128061c07472304601766bddf949647c5ca92e8ee768a77139bbe91bdfaaae99dea4405168ea9
Score

1^/10
behavioral21 behavioral22
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/js/logger.js
- Size
  
  253B
- MD5
  
  1d26f69361e75ca5cd2eac5f99249c72
- SHA1
  
  787d51c708ce15b2c533a180a2bf639648bc40eb
- SHA256
  
  d7d63601d3347efc93425f4f93049cfb9ed2b9ead1dce662c9c1bed3cba302e0
- SHA512
  
  7350774074462d33ac9f2e130829306af08a6693fd597f40c39bfb194684f66d965cd23c10de5fc4389e4a2ffe84db727aad23dd683a805ae4825f10026cb040
Score

1^/10
behavioral23 behavioral24
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/js/releases/index.js
- Size
  
  10KB
- MD5
  
  e8282413c1895eaff49de6dd9b71ab13
- SHA1
  
  4e058f522a46e20bbd26f15a6922390ec2c1da36
- SHA256
  
  d6a28994173c1c36476121f8b0e3633e01ecd0589289901fba34fe218293443d
- SHA512
  
  301d2a6ae958e1ba936cae6f555a587ad87567055f4709d4676a3ef5b1a3112cb338b8a9e744c24cbfa784f00f13a1118ad48fd4f6bb060c5608e4ddc8779389
- SSDEEP
  
  192:0SLrK4h1VeAdTeTj8rHiZNWgqAKezwec2D6LaQLonNbcWdw2SEfsjy7J1nDIDu:13DLdKHaMKezw1QNbXPsfu
Score

1^/10
behavioral25 behavioral26
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/js/releases/options/deploys.js
- Size
  
  368B
- MD5
  
  f42c24cde0162b93624df51f4e2abfab
- SHA1
  
  f819638944878ac4cb49438d8599d3fbd9081949
- SHA256
  
  3f2316e7fb20e82df9a8b08d6169a622a89808742806adee2e4d89885962357d
- SHA512
  
  67258cbaf9f46f1609cec9b87b7a577f855cde9c8efafa3d835a0d18fb3903fcc4733489bf81447cdf2c0a55701d569a75f11a81865dab8f624b722e76b7c674
Score

1^/10
behavioral27 behavioral28
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/js/releases/options/uploadSourcemaps.js
- Size
  
  1KB
- MD5
  
  d060ac623857ad5ca08e3a944768925a
- SHA1
  
  26fe78c92f55f9529ffa2b71da403873da29313f
- SHA256
  
  8d4bd4c779e177724aa7bf98e768e50ce8b2950ef5bf39fa08033057b400888b
- SHA512
  
  ae1b42d7e5c5d60f935bcd08417d4d9055d71bfb80653281e990a687353592731a7c4423655fbb988728152846aa56a5f180335d254885338bf6c96ef2a8357a
Score

1^/10
behavioral29 behavioral30
- Target
  
  resources/app.asar.unpacked/node_modules/@sentry/cli/scripts/build-in-docker.sh
- Size
  
  931B
- MD5
  
  94b0fc212af523b8bfcd6c2aa5a5ab2a
- SHA1
  
  cc0cb35f7ce729f7affe6b2c463e57966515e476
- SHA256
  
  abaa92d196f6752f184b83b19aedd9b1e28d328e6817de213f61fbd108351e16
- SHA512
  
  af0a2174e0304fdaa56ddae249049c142450ad4a0a9c8975548f61aa2bc356837b1d7ed441108156af32c979da5647bd0233a49db700ff0bbf528f9fa2c862e6
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Loads dropped DLL

Deletes itself

Checks CPU configuration

Reads CPU attributes

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32