Overview

overview

7

Static

static

3

geode-inst...in.exe

windows7-x64

7

geode-inst...in.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Geode.dll

windows7-x64

1

Geode.dll

windows10-2004-x64

1

GeodeUninstaller.exe

windows7-x64

7

GeodeUninstaller.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

GeodeUpdater.exe

windows7-x64

1

GeodeUpdater.exe

windows10-2004-x64

1

VC_redist.x86.exe

windows7-x64

4

VC_redist.x86.exe

windows10-2004-x64

4

XInput9_1_0.dll

windows7-x64

1

XInput9_1_0.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    geode-installer-v2.0.0-beta.25-win.exe

  • Size

    25.9MB

  • Sample

    240503-1w96xafe7x

  • MD5

    739fba4e8399983df01dfa4dd6db2052

  • SHA1

    e9a981a70fe74074407cc484aea6673a38dc7c9e

  • SHA256

    d3efb7084142e12b3fe6cdb51c46c1ae643451cc73b4fff3680b307006ff0460

  • SHA512

    7c685992d9c47be33f4fb80483a74e02bba07972d41a67b87508fcab3c4f8ef3ac3fd2ff8be72f15c648c55c8e01c14175985e1ac42dd9d7b509bf5d44d7fff9

  • SSDEEP

    786432:UH+yMa+SPOmfqMxIJ0gDD3untXB7Ep+zJfKcf2zuP9N:UH+y3FO+0tDuntXB7E4zH289N

Score
7/10
discovery

Malware Config

Targets

    • Target

      geode-installer-v2.0.0-beta.25-win.exe

    • Size

      25.9MB

    • MD5

      739fba4e8399983df01dfa4dd6db2052

    • SHA1

      e9a981a70fe74074407cc484aea6673a38dc7c9e

    • SHA256

      d3efb7084142e12b3fe6cdb51c46c1ae643451cc73b4fff3680b307006ff0460

    • SHA512

      7c685992d9c47be33f4fb80483a74e02bba07972d41a67b87508fcab3c4f8ef3ac3fd2ff8be72f15c648c55c8e01c14175985e1ac42dd9d7b509bf5d44d7fff9

    • SSDEEP

      786432:UH+yMa+SPOmfqMxIJ0gDD3untXB7Ep+zJfKcf2zuP9N:UH+y3FO+0tDuntXB7E4zH289N

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral7behavioral8

    • Target

      Geode.dll

    • Size

      7.6MB

    • MD5

      713ddaf42398df8f5a1c0bb7ec5126be

    • SHA1

      7e3d4e5e36112d5555d89ac293bc1b854818e056

    • SHA256

      0971845e11b3bb97b288269b87446fd0c5b5ba99748e540dd8dcd97a8b630902

    • SHA512

      3cafe3304cf8f504b6b5a2add37a4c3cb5d841aca558e96e809ff75878a02f3234d4f5d60185b153fcb049af7f673a0c00b94faf946bbdd91333389a4d4943b8

    • SSDEEP

      49152:ebF3sSnWuvbY1ogidgqyrFfdi3ieOak5JzBZhUlqFQ03SScIRdpfo:YJnhbY5aOaOZhU703SScIRdp

    Score
    1/10
    behavioral10behavioral9

    • Target

      GeodeUninstaller.exe

    • Size

      95KB

    • MD5

      0bf110e9c41324bdf9bc462f5acb5850

    • SHA1

      2a10b58958d9abae572d47047c1e7710541d69c7

    • SHA256

      cb2243df5601ee930125c639d2ed4e2fe3bc8b281d2d8dd13803c624292f5114

    • SHA512

      409c54d58e66a8608c6c80685a4c8dc2554e3b0ce155760df6002a15d80611bb458d9fecd279fb39918f274e14c997737410d16d8639606493b13ec7c4af59c6

    • SSDEEP

      1536:2ferrLkSRoe8C4UZsys0Dh1duO8d6gscIrkvPM1zdafEX7IS0hyv4uL7010n6BBE:2fi3k+oWDBDh1dud3IrkvPM1YlhGN70o

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      50016010fb0d8db2bc4cd258ceb43be5

    • SHA1

      44ba95ee12e69da72478cf358c93533a9c7a01dc

    • SHA256

      32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    • SHA512

      ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

    • SSDEEP

      48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral17behavioral18

    • Target

      GeodeUpdater.exe

    • Size

      70KB

    • MD5

      9e87037197e4b552734a7fc1965a62fc

    • SHA1

      68bb1371d992ac0a8818eaf2ea0105f3e4b0d707

    • SHA256

      5b5e964c18e118e72a6c2cd5caf01333264d6f939c6ee3a7985a9a24fd85be64

    • SHA512

      4cf67d4e43902d84b04182454291b8dec8e5c2fb24696c7c3f70fe6c0d782e1a569e1774163bc9e9368523a90407c39cd4a42c30a6d88d2bbda4212a15b97a90

    • SSDEEP

      1536:JQCghUldOxWRnHrXJS/WbVn1JSSZRNASzoVwpyv8Af:JQCghUldOxWRnHrXJSu5n1PZi0yEA

    Score
    1/10
    behavioral19behavioral20

    • Target

      VC_redist.x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral21behavioral22

    • Target

      XInput9_1_0.dll

    • Size

      11KB

    • MD5

      e7f1cc85f97c92b5eca447ed7ca7dabb

    • SHA1

      6512719f6a0875675034e39f0cd29f435c42b008

    • SHA256

      9e25ae49f8a2061d2c31f9c1c381010e04f7c3800f33daf47168763a2b9ccfb1

    • SHA512

      bdd0814327a8cc14a11210745b3e9ed4def7629b32a8fa4a7ac139e1ba0238e49e057d49f4d49ac2b599dab172edbd2b1adc9ba274cc9057652abc2b5243ac46

    • SSDEEP

      192:EQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyfaCwmPgbDLTGc:K/SspI2WgHJZlj/fa/tvi

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks