Overview

overview

7

Static

static

3

geode-inst...in.exe

windows7-x64

7

geode-inst...in.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Geode.dll

windows7-x64

1

Geode.dll

windows10-2004-x64

1

GeodeUpdater.exe

windows7-x64

1

GeodeUpdater.exe

windows10-2004-x64

1

VC_redist.x86.exe

windows7-x64

4

VC_redist.x86.exe

windows10-2004-x64

4

XInput9_1_0.dll

windows7-x64

1

XInput9_1_0.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    geode-installer-v2.0.0-beta.26-win.exe

  • Size

    25.9MB

  • Sample

    240526-czmb9abf7z

  • MD5

    39d10002616e6d2142c8c1aeeec6327d

  • SHA1

    c8b934c3ef5a82672dbaba0ff6671b29c53911cf

  • SHA256

    2d5db17bbbb72469b53f2c1801e27e79a2dc83f266ca34710e4689d0c7b03cf6

  • SHA512

    9988a04be109630114085463a6d90a426c9c8384edbbd8718cc5789bd29a955f8c6a90ab1f3b89a4d6ba3dd18128eae1bd65d261ca54f6c639cb94368235d72b

  • SSDEEP

    786432:H4ybYCHgLccSo3DzHntXB7Ep+zJfKcf2zuP90:H40pA4cSkXHntXB7E4zH2890

Score
7/10
discovery

Malware Config

Targets

    • Target

      geode-installer-v2.0.0-beta.26-win.exe

    • Size

      25.9MB

    • MD5

      39d10002616e6d2142c8c1aeeec6327d

    • SHA1

      c8b934c3ef5a82672dbaba0ff6671b29c53911cf

    • SHA256

      2d5db17bbbb72469b53f2c1801e27e79a2dc83f266ca34710e4689d0c7b03cf6

    • SHA512

      9988a04be109630114085463a6d90a426c9c8384edbbd8718cc5789bd29a955f8c6a90ab1f3b89a4d6ba3dd18128eae1bd65d261ca54f6c639cb94368235d72b

    • SSDEEP

      786432:H4ybYCHgLccSo3DzHntXB7Ep+zJfKcf2zuP90:H40pA4cSkXHntXB7E4zH2890

    Score
    7/10

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      549ee11198143574f4d9953198a09fe8

    • SHA1

      2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1

    • SHA256

      131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36

    • SHA512

      0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8

    • SSDEEP

      48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      192639861e3dc2dc5c08bb8f8c7260d5

    • SHA1

      58d30e460609e22fa0098bc27d928b689ef9af78

    • SHA256

      23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

    • SHA512

      6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

    • SSDEEP

      192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      b7d61f3f56abf7b7ff0d4e7da3ad783d

    • SHA1

      15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

    • SHA256

      89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

    • SHA512

      6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

    • SSDEEP

      96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc

    Score
    3/10
    behavioral7behavioral8

    • Target

      Geode.dll

    • Size

      7.6MB

    • MD5

      67c1253572cd9d7a9442f588ca1a661d

    • SHA1

      12a7863dff42c3e1a7d2ca394446050e5746657b

    • SHA256

      e1aaf9bd013eb8f3ada9409365b40a92d7b81bcd44edcdd06fed00791594dad3

    • SHA512

      ac0f24541ff4c44fb7599159e6ca8f2a37f6c59c7edc2ea8aeac82d08baf957a9e77edac4fa9461865207281188f8b92dc3caf1be85bdd0f84336b0c037d54cd

    • SSDEEP

      49152:JuOIJaCPplBdJxCeaevXDP7IUgGdfIfwIhxmIXUnksV70pg9ToPchQ0w4UpOF83e:zMa2pZdfIbXUksv9Td20w4UpOF83

    Score
    1/10
    behavioral10behavioral9

    • Target

      GeodeUpdater.exe

    • Size

      70KB

    • MD5

      4d69d347088fa313fbdb2f98279142f9

    • SHA1

      e7ccdef269a7f7b05f6b46fd78030bc8e2e4a880

    • SHA256

      a6705d49b6762a8d08237263d659636522c893ae9ee7af3a52eb6df99dbe4f08

    • SHA512

      3af1068f387dcab4e175f61dd3764423c605d1fd20fbd86a7580a8449932c59bd051fe5939c87248665c8fae1588e24a611f33d0de87a6d7d5680963278b8701

    • SSDEEP

      1536:bQCghUldOxWRnHrXJS/WbVn1JSSZRNASzoVwpy0q8Af:bQCghUldOxWRnHrXJSu5n1PZi0y0TA

    Score
    1/10
    behavioral11behavioral12

    • Target

      VC_redist.x86.exe

    • Size

      13.2MB

    • MD5

      9882a328c8414274555845fa6b542d1e

    • SHA1

      ab4a97610b127d68c45311deabfbcd8aa7066f4b

    • SHA256

      510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79

    • SHA512

      c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2

    • SSDEEP

      196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE

    Score
    4/10
    discovery
    behavioral13behavioral14

    • Target

      XInput9_1_0.dll

    • Size

      11KB

    • MD5

      4a4fc6a84d38dd216ec05f9e6582fb63

    • SHA1

      6369a8c0edaa3c579971495d9707ed2776934bd8

    • SHA256

      f84092d25bb4a987df76c6d4687cc21fddfa354a1ffb1c932fc804c3fbcec725

    • SHA512

      d7197c626069544f0f0d86aa9eb3e69efe6a0b0286850a29539162ca5c1cd66f9c38d63b7d0936ad85020c451e070f719c8309a7bff0c5462621d43e3357a1e4

    • SSDEEP

      192:XHQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOytaCwmPgbDLTGc:XT/SspI2WgHJZlj/ta/tvi

    Score
    1/10
    behavioral15behavioral16

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks