Overview

overview

7

Static

static

3

HS Loader.exe

windows10-2004-x64

7

HS Loader.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows11-21h2-x64

3

HS Loader.exe

windows10-2004-x64

7

HS Loader.exe

windows11-21h2-x64

7

LICENSE.electron.txt

windows10-2004-x64

1

LICENSE.electron.txt

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

1

LICENSES.c...m.html

windows11-21h2-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows10-2004-x64

1

resources/elevate.exe

windows11-21h2-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows10-2004-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    HS Loader.exe
  • Size 84.1MB
  • Sample240502-c9963aeh2s
  • SHA256 4ef73303cbf4258a6ff87a80daf95ddc43b82e5f4ed9c6ae64392c66ed231549
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Targets

    • Target
      HS Loader.exe
    • Size 84.1MB
    • SHA256 4ef73303cbf4258a6ff87a80daf95ddc43b82e5f4ed9c6ae64392c66ed231549
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    spywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/app-64.7z
    • Size 83.7MB
    • SHA256 6c373c888da36e7d3143509089338874969851b6b7e135892e90bb568bfd5ab5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      HS Loader.exe
    • Size 164.7MB
    • SHA256 c580316aa6c2fc57b218afc93e4b8c457acfad0f25780a23ae2778135ad8cc8d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral10behavioral9
    • Target
      LICENSE.electron.txt
    • Size 1KB
    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral11behavioral12
    • Target
      LICENSES.chromium.html
    • Size 8.8MB
    • SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      ffmpeg.dll
    • Size 2.8MB
    • SHA256 bf744924cf808c38d4f5762dcdda440b2f6b491794ca0c46c15a04d3297d6a1a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      libEGL.dll
    • Size 477KB
    • SHA256 43d0e9d697ea51e229d4ccc53cdfeec54c79d6745071ef882dc5d651ae91fc6b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      libGLESv2.dll
    • Size 7.3MB
    • SHA256 798c4173428eccea4950d20662312a42f622c3936cc9e2e1e86f1c2b832274da
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      vk_swiftshader.dll
    • Size 4.9MB
    • SHA256 2bf61db50d0226c079c7b6516f36e76b46d1ba35cbc483dd625d8c83bef70dcb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      vulkan-1.dll
    • Size 931KB
    • SHA256 699730471255f848f4d73ccc7bba22dfb9e3bb54c44121375e9bd9ef5c7de605
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Tasks