Overview

overview

7

Static

static

3

GDLauncher...64.exe

windows7-x64

4

GDLauncher...64.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

GDLauncher.exe

windows7-x64

1

GDLauncher.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

owutility.dll

windows7-x64

1

owutility.dll

windows10-2004-x64

1

resources/...li.exe

windows7-x64

1

resources/...li.exe

windows10-2004-x64

1

resources/...le.exe

windows7-x64

1

resources/...le.exe

windows10-2004-x64

5

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GDLauncher__2.0.8__win__x64.exe

  • Size

    111.3MB

  • Sample

    240503-wvw6fafg59

  • MD5

    f631466f5bf6ae4cc85dfacadac1860c

  • SHA1

    6d5d68e07a02fe9bad3dc5a964957fa104e2c2dd

  • SHA256

    e8784b21f05c7f91ae6082ae912ddefddf62bccf717c2a9f649f147eb28eadbb

  • SHA512

    c8c602b4bfda26e848c13be051340c3d15bde20f9124cde45f0be25a5b178315a273c031cce8bf92f1ffe27141ca9b8885938a3ea9cac4fb36aa23e3525d2461

  • SSDEEP

    3145728:G1e4/oxfXnUMT8w4PAizShIsS3sclI879omN:34/YXhcPj6IsS8cGcrN

Score
7/10
discoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      GDLauncher__2.0.8__win__x64.exe

    • Size

      111.3MB

    • MD5

      f631466f5bf6ae4cc85dfacadac1860c

    • SHA1

      6d5d68e07a02fe9bad3dc5a964957fa104e2c2dd

    • SHA256

      e8784b21f05c7f91ae6082ae912ddefddf62bccf717c2a9f649f147eb28eadbb

    • SHA512

      c8c602b4bfda26e848c13be051340c3d15bde20f9124cde45f0be25a5b178315a273c031cce8bf92f1ffe27141ca9b8885938a3ea9cac4fb36aa23e3525d2461

    • SSDEEP

      3145728:G1e4/oxfXnUMT8w4PAizShIsS3sclI879omN:34/YXhcPj6IsS8cGcrN

    Score
    7/10
    discoveryexecutionspywarestealer

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral10behavioral9

    • Target

      GDLauncher.exe

    • Size

      169.9MB

    • MD5

      52b6403f53e1ada74df7084129952d0d

    • SHA1

      ea11febd4cbb09544b088aec2c6ffa2b42f83959

    • SHA256

      a8735f79159bdfed49768d007be08f60a8e4b2c28327c384e2e0f80ce5b6e7cf

    • SHA512

      197253a33c7a72b1adac0becf6e3bb5e5385f2ee96aab01d377d7ad0ea96c09a69436e38e57e2196be4f348e63be873ba0c90194f0ced3263c730bf5880bfaa2

    • SSDEEP

      1572864:bs+fxQiW1vVzbHpUcEtmLd7cF3PPHNzLuTe7ulsxM/Gyr/w7VoB4X+x2CFRXQQS+:ee8BWNg3DFxf1

    Score
    7/10
    discoveryexecutionspywarestealer

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral11behavioral12

    • Target

      LICENSES.chromium.html

    • Size

      8.7MB

    • MD5

      fcb299831276a7c8bdeb036142da1c25

    • SHA1

      bf6990abb92ab627b7f2e7aecbd5a58b86d2e09a

    • SHA256

      6daa3cd398e5380222c6b6bdb4d66a4b4273d4bb74d6bf53495a5722f03ac0dc

    • SHA512

      1e31ac0b6836d24488e32d04b5028ac2a9e00ebd8e29aaf742d9e0cdb50d5a9d4f7bcc3919b22a793552d31aaed2104415268f14e903754bf25a86510fbc98c9

    • SSDEEP

      24576:RQQa6NA6P5dWWSmwRFXe1vmfpV6k626D6b62vCuApj:RWfTF0

    Score
    1/10
    behavioral13behavioral14

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      f59294d4012d69b80205b8e1830a5a7c

    • SHA1

      34d3a480f6799cf904aba944511383f31c24d3ea

    • SHA256

      c15d5cadfaa022c6cf37ed34a81e2f2e7cdca1b8e017a2576702e9fa80b03e75

    • SHA512

      909c4598adf539d685e0ceeac7aa64dfd6c765eacc0392d1f5c48d2bb26154f973c1c499bf69c07c502244a5694611ef06d0e634ff09a4140321638e9f1e45b5

    • SSDEEP

      49152:uCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRN6:9G2QCwmHPnog/pzHAo/A6v

    Score
    1/10
    behavioral15

    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      3a874fa432f621b517c8c562fdb3e150

    • SHA1

      6b43833ca5ec931824086cecb878a83aef0bde9f

    • SHA256

      87eea23eafd23fe15a500827cb1a8724abcde2b711737b5ee12a038ebd9a0176

    • SHA512

      2953eb4cc66bd2089a67f138e95810d494e4b826be4b79227936c625809589259a63e19adcb9be8e2d90ffed31f9ca0f18324669de783a6ec7255e94a1637f81

    • SSDEEP

      49152:5PDtyvMYqXiOamQ7NyjmnMDbG7OUx7n6mfu/oB7pweIcgsxqeUsn/uL:9SOqNIoQG7OUrd/xKsn/uL

    Score
    1/10
    behavioral16behavioral17

    • Target

      libEGL.dll

    • Size

      477KB

    • MD5

      9961be7be92a37f982a586a1b5893a72

    • SHA1

      301abdd2226e5369e02ef0fc54358cd9069657f7

    • SHA256

      d9b7daf09b891407f5fa0a406853d370a654cb145a11012195be33ee616c1acd

    • SHA512

      7fa6f83203bd92b7e525940e9deed8968c5dd4dec7c82192acd1ba239c0b1686050dd294eb6a08439e6a81f019b77cd2d17679383a6628b795671e98a21a1d2a

    • SSDEEP

      6144:3uF2DwTNCKxOUxcfDVTyKH/VbPGtWQAOWIBtuKYbu7DB0:+DCKsAcfDVjktWQAOWIubgO

    Score
    1/10
    behavioral18behavioral19

    • Target

      libGLESv2.dll

    • Size

      7.5MB

    • MD5

      2718694e3a8b2ba7ac7ef71c7a0ef4aa

    • SHA1

      7ba04084be9d853c7c4f835a7f714425794c3523

    • SHA256

      ae39ba9c938a17b90445fdaaa184e710ea405e21784a6cc9caa10320a49c6cfd

    • SHA512

      2e1594506ecd3035f31e134eaa2eeb1d98b12f0917f0dd153bbb8a6931d4438bdaae7d96770c1c1aeef9af4bfaae3af524fb9ea6c2f785530f579d12d70256dc

    • SSDEEP

      98304:qYM1bKnyhXV3X4Nf/eW74heor1up6sDCpaXm3TVZ:qL1jlX4F7ivuyUCTVZ

    Score
    1/10
    behavioral20behavioral21

    • Target

      owutility.dll

    • Size

      1.5MB

    • MD5

      651be77b72f07779b26f2e2df4c95324

    • SHA1

      3285a850ff632659cebfd3be8e3e65730b483b1d

    • SHA256

      9ce3065cdc8b581a4dc33ebc98f6ea98933e75b87e262834c21c46dfb3bd5048

    • SHA512

      020ca2db9147df510013beb6fb0ab1b8cf491e5505d2040c35f66c29b8858dd787361dd092a2b13c817eebae57690a9020f5da310452a4c21762826d2fe758a9

    • SSDEEP

      24576:mjjAyN7CbTB3Iu2VIMiFryCF9fLp34G5cdHSdslQ3m3oGch+XaxLaXp/:mjcyNeR3IuUIMiFLFpLp3z5cdgsvYFhU

    Score
    1/10
    behavioral22behavioral23

    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe

    • Size

      7.3MB

    • MD5

      2fbcfe6059c7faaad6dadb56992f7996

    • SHA1

      1a0326c6d0740de9035bc8899e4a249189f01c3b

    • SHA256

      9f2ac1933960708f89817cdc7898074563f796713b0bb94f5eadbc832dc31189

    • SHA512

      64939837ec34b39a3b31d8e424229e1e408c7a6448bd02a11e755e17c74edb6a582165e6e0ab6fa504c7cbb25f69095ba72ad84dc435026d0ebdbf73d475c0c6

    • SSDEEP

      98304:ZK/JXOfs1oY6qWAIhUzgtDZhyfstGwAxDujtC3wdHErg7eYSG8G+Po:M/O/5DZteZu2wdHErgURG+Po

    Score
    1/10
    behavioral24behavioral25

    • Target

      resources/binaries/core_module.exe

    • Size

      26.1MB

    • MD5

      5427ce634d9d9ea2fe94ce0c947124f5

    • SHA1

      5e693b9c95a829ce6c6d1b0152b370fa3ddf92fa

    • SHA256

      e4291191bc1dd8f60310694869fd9437710f3059ac726377a07fadf9bce70e9f

    • SHA512

      cf5f1e59f12fe2db60bd056ab60da9db8fe28852656a60df9a75767fae3b6ebca1c505cf13bcf2b3bd78e0f2ad8a2842103d83c9588de7097665d206237548d9

    • SSDEEP

      196608:zOo6/vkrmIP7/5W542YFsaHHR6f32qzQ01QCoU:ZcYP7/CMA32qmQ

    Score
    5/10

    • Drops file in System32 directory

    behavioral26behavioral27

    • Target

      resources/elevate.exe

    • Size

      115KB

    • MD5

      94faad96bcc3c1e083b57eb67b7eb92b

    • SHA1

      521bc7befd021086ee1dcc8a33d5358eb81281ff

    • SHA256

      a55770be41bb05c4b422b53defc4a36d2fd5dede970eb199625ad4c1efb37c3f

    • SHA512

      7433fbd9ea712fdaad2b144c6aeb70bcf537545c64f4c3a27098cb5bd833ef3712a206711fe1244b1e9c5b2e358ecd53e30462af18afa563d4de222e12f1f568

    • SSDEEP

      3072:/abLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl/X:SPrwRhte1XsE1lf

    Score
    1/10
    behavioral28behavioral29

    • Target

      vk_swiftshader.dll

    • Size

      5.0MB

    • MD5

      97f3eb7a38e6e9ec6757f320170d6171

    • SHA1

      38f3165cb5243b38c33c34d88171f8a5f5668221

    • SHA256

      79d822c157881b46c1136b14fd5164da9c528f0b1f2f0cc5ceed4b5fd4060c9f

    • SHA512

      ca3d6dd07b848a045fc8976c058a01ce6ecf8ac0f2e121531435906ab66610fdd574fd1125dce4cc2a2f884000f32b54604a6b67f708c0feb14fff1291ab6996

    • SSDEEP

      49152:OO6ftEjL3Zdon2+a/EgBqB1y91lxfAV7xWV9cO6NZ8m8xg1drRXmVEZvMUn0Hjyw:OLftlUSot6EmXxZdIOl5bzLB3dIWY

    Score
    1/10
    behavioral30behavioral31

    • Target

      vulkan-1.dll

    • Size

      935KB

    • MD5

      d8bbc2f245dfae4094db4b9ce77bc3af

    • SHA1

      654efbff9894120f6f1030a47a96074c838e88a9

    • SHA256

      56d3cc80ca50f32cedf0a720d6bfc38647566e39630e1907d76e3995e4651492

    • SHA512

      7ba6322b23e987f7908dae01fc277c5573bd85e219afb330fe2de1b7be281febf9908ad21957c0600f2b1d4a7aec7f00e54ec22d59b95ba573a6b077daf7b24f

    • SSDEEP

      24576:zy+lCO+5ian96u6WbEJXay6Z5WdDYsH26g3P0zAk7o3uk:zymViaWbYT6Z5WdDYsH26g3P0zAk7ot

    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
4/10

behavioral2

discoveryexecutionspywarestealer
Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

discoveryexecutionspywarestealer
Score
7/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
5/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10