ee521bcb04388d9a585eee8be0101bec54aa4dca29d8a1a67d8ed39858518d61

Sharing

Copy URL

Twitter E-mail

General

Target

CurseForge - Installer.exe
Size

2.0MB
Sample

240522-z1bcpsgg7s
MD5

94007be8e74fc0c83d0d5496478da708
SHA1

95aec833bb6555d5be46941d3d0c702c25d848f3
SHA256

ee521bcb04388d9a585eee8be0101bec54aa4dca29d8a1a67d8ed39858518d61
SHA512

3f9e403faa284b3f44fb6db658620d8cf15dc6321052848effc5b50759c5c3e37dace18ad9a828a883513afee900ade3b0b045f39b8e97feaac9840958fdf5fc
SSDEEP

49152:BAzYQWxE87vxpsrFpIvq465HHbkvjgs3NbWsRszY3NDCcaP:BAzYQIPN+TIvF65HEv3NbWsRJM

Score

7^/10

Malware Config

Targets

- Target
  
  CurseForge - Installer.exe
- Size
  
  2.0MB
- MD5
  
  94007be8e74fc0c83d0d5496478da708
- SHA1
  
  95aec833bb6555d5be46941d3d0c702c25d848f3
- SHA256
  
  ee521bcb04388d9a585eee8be0101bec54aa4dca29d8a1a67d8ed39858518d61
- SHA512
  
  3f9e403faa284b3f44fb6db658620d8cf15dc6321052848effc5b50759c5c3e37dace18ad9a828a883513afee900ade3b0b045f39b8e97feaac9840958fdf5fc
- SSDEEP
  
  49152:BAzYQWxE87vxpsrFpIvq465HHbkvjgs3NbWsRszY3NDCcaP:BAzYQIPN+TIvF65HEv3NbWsRJM
Score

5^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/app/cmp.html
- Size
  
  5KB
- MD5
  
  d7b8b31b190e552677589cfd4cbb5d8e
- SHA1
  
  09ffb3c63991d5c932c819393de489268bd3ab88
- SHA256
  
  6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
- SHA512
  
  32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
- SSDEEP
  
  48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/app/index.html
- Size
  
  20KB
- MD5
  
  c7b752acf6d1e10f3aca2c67b1ccf4d3
- SHA1
  
  ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7
- SHA256
  
  69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc
- SHA512
  
  120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576
- SSDEEP
  
  192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8D:+WNaM8UnbjPk89+mppHL
Score

1^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/app/js/app.js
- Size
  
  21KB
- MD5
  
  f718bd3f18dd499612623852cd2a2135
- SHA1
  
  9432b7898f655fbbd8132f4b3f8822959ae3ff97
- SHA256
  
  a14fcaf11a16ad7d904960538ca35d5b05e1c1b6a916f228db6b319c6195acbb
- SHA512
  
  90a697f93f239e8210ad47b6f012d3b40ea9c23a92ab909434d0e2d71bc3d9663d1aa73c64646e3dbf417f9636d1190b3d0cf20d349456dee6b6b8d5536d0338
- SSDEEP
  
  384:4X+acDQrcljKdZGb9plmt902wjI3A4nzwF52xxYRifG6wBEoR3FGHWdeLj8T:0+acDQYlOdEbdmXH3A4nzIAnGifG11RL
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/app/js/block_inputs.js
- Size
  
  789B
- MD5
  
  b5b52c92b90f4283a761cb8a40860c75
- SHA1
  
  7212e7e566795017e179e7b9c9bf223b0cdb9ec2
- SHA256
  
  f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
- SHA512
  
  16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/app/js/libs/cmp.bundle.js
- Size
  
  324KB
- MD5
  
  1de143ca1babd3c02744f478c8c05c5f
- SHA1
  
  ac918b3d2d5f9cbd9e3b3f5e075ce3c96eec16b3
- SHA256
  
  7fbc3a088ec303143109e0c1b2c04f4c5a6e450a2d6f3071fefb66e92f643ea0
- SHA512
  
  6e419e11f35a3258124127970961907ed8fe0619f618a4c15542ee7f8a01a9f4a7af4d290b634444d21b823ca1afea65f97d5788fff6665d55c2231214edff24
- SSDEEP
  
  3072:LWYyrzt6yrtky1UDtDkNdAOoSPGYTckZtVPuuXheQ:oF6yrKD5kNYYTcIp
Score

3^/10

execution
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/app/js/libs/jquery-1.10.2.min.js
- Size
  
  90KB
- MD5
  
  44e3f0db3e4ab6fedc5758c05cf27591
- SHA1
  
  2d408aa1d35661019c95adcc60b78c0727ed25b4
- SHA256
  
  bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
- SHA512
  
  4d4844e53e686fc59a52e86588f328dca3ed6fdad7195c58942a98c51755a24981b903ee7c7b27785375eaad5a7d9501cf74b999674b79f214e66103bad9efdc
- SSDEEP
  
  1536:O4mCgi8DyCuXXFiJ+L0kJQsJVPEKuQRZdC/RAfDknv+p0WzH/Io9Z7qABZnu0JFV:OGsKYAI2p0WP9bDrJ7fak
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/app/js/models/notifications.js
- Size
  
  5KB
- MD5
  
  85afdf9897bb1236eff3afa40d15ece6
- SHA1
  
  4362bdd139458eaf4a2dcb34294b43e2d53f4a26
- SHA256
  
  9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32
- SHA512
  
  4ab86c6bafba18f53f01ca913ceaa80f14900107069a1d5f65b108d35690bd8b50b1a6cdf1563fc5775909f69208dabebd139f3cf3d8576269d560d57cf9994c
- SSDEEP
  
  96:sOr8u1s9FvYYdfHsW/GZwzpJGf8mui+U8QrGjqTzoOxOYsdfHsW/GZwzpJGNjINU:sGu9yYl3rNQ8K+JQC+/5Lsl3rNOEYIo
Score

3^/10

execution
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/app/js/utils/analytics.js
- Size
  
  4KB
- MD5
  
  525281e9959af4c1c0d11b9243c798a1
- SHA1
  
  237a84c5b57bd132f48446d718b20640cb28c263
- SHA256
  
  c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d
- SHA512
  
  fe5bafda7773e69c65dd63270e0306abcd39cb2d886b675ab8c714ae0833efde963b69623d468551a1ab37f1db1a1d457f1568f7a29d9cf0bb23bb0edcab5fc4
- SSDEEP
  
  96:LlYkmHqqVHlnZ4JGvt+QP2EvVVko3sO2LCgObNS1Tgzalh:AHq1GV+kcRObNSGza3
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  $PLUGINSDIR/app/js/utils/commands.js
- Size
  
  12KB
- MD5
  
  65015f2e2e490f6786abc0560e33e1d0
- SHA1
  
  47b5c2b3b1f9381e4d2b9d1f3d82ba62828ce28e
- SHA256
  
  e874c959c7b8e4351d730d263231df7176b5062580a7d3e0a2684001b510f5d7
- SHA512
  
  a4ad579acfa6000fd8074893a6b45df74558c57afd5b957217491784fa25df370c59d9f92ff245abbdf3d26b42114cc22359ef95c4baa322e326c7e210f43edf
- SSDEEP
  
  384:7/W5HB8c36uUvJQ006W8tusv5qEWTwdSW:rFOs5
Score

3^/10

execution
behavioral19 behavioral20
- Target
  
  $PLUGINSDIR/app/js/utils/cookies.js
- Size
  
  1KB
- MD5
  
  6c60e675f8c8c68c0174b644d3a63a2a
- SHA1
  
  3635a3fe07ccc4a6f33a986ddb690522d0611abb
- SHA256
  
  9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
- SHA512
  
  1dc9ec7b139bcf37107ecd673c01e4fcc606332ea1645a4a1b4e5d95f817d4c99d5964cd3d941a6a526689341d9623b17b4efc002cdf4c73404299d52b1be452
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  $PLUGINSDIR/app/js/utils/modal-events-delegate.js
- Size
  
  1KB
- MD5
  
  117e4fdbdb0ecf211c8bd909efd337d1
- SHA1
  
  9f8684d856b7c95bdffb139217dfd89f41373187
- SHA256
  
  267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
- SHA512
  
  f474ee20b59d3d0c11f9f6aee6b6e2b66f7025beaec9841f88455e60533dc96cb4e27910be0dae92b0028c5578932b7f459fdb91d594ad010f72a3b3af6addb1
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  $PLUGINSDIR/app/js/utils/strings-loader.js
- Size
  
  5KB
- MD5
  
  9c94eb933d8a43dd3825e67a7e30c980
- SHA1
  
  7ec7b16af6f399219209ba5967d377040486a11b
- SHA256
  
  96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
- SHA512
  
  a662a299e31633f71a9b9675970359430fdac06dcc284fd7ce92919f244c7f921639f97a42356e993a95865e6c9f198dcba82c126f82065bf2009a31ec9b02f5
- SSDEEP
  
  96:FXS/WSBWlbBtDhWFTnTeWsNkEj1I/6WfwkUlx416moPdXDKP8j8yZrME6:FXSuQwBBh0nTevNkEj1O6Wme0muXDK0W
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  $PLUGINSDIR/app/js/utils/utils.js
- Size
  
  118B
- MD5
  
  a0952ebeab701c05c75710c33d725e7e
- SHA1
  
  1da8a2e889f1213d481ae3cd5571670c01e64adc
- SHA256
  
  b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
- SHA512
  
  5e5ae616d3fded7d2bf47a326242c4477ca3119fb52897bfb41de0be230ccbd6c3da2c00268b3973e9bf7b4f2886aba64fd9719b448662e4130ee66d87913389
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  $PLUGINSDIR/app/js/windows/cri/cri-controller.js
- Size
  
  3KB
- MD5
  
  4e4b4a9e2d86ae3c108105078db6d730
- SHA1
  
  826946be793c999316af6c1db10523950b18ea2c
- SHA256
  
  cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7
- SHA512
  
  1420065cd000ce9b9c39d27b5dc5f4055f67146e06573a03184649851c9745f0c0af2b5e35b41b5923703dd74e32f9ed95fc59a43db25f854584e319950beffe
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  $PLUGINSDIR/app/js/windows/cri/template.js
- Size
  
  1KB
- MD5
  
  76c1ef0cb437db144c2bed53a5a8a5d7
- SHA1
  
  aaab8fff649f8e46d1e9510018118ee9abe01498
- SHA256
  
  505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e
- SHA512
  
  822bf9feda91c89539d263c6c9053163e8dfa3c511195bc61a9b608b4687fb4048733323f03dd30a7ab661a4be4acf6c8d8ae7bb6723771122540a9551899c3e
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32