42ad279878792b976f051847fc40e8b31fb4a043cc440455fca28b8f9a252271

Sharing

Copy URL Twitter E-mail

General

Target
GDLauncher__2.0.9__win__x64.exe
Size 111.3MB
Sample240603-3p5c7aec79
SHA256 42ad279878792b976f051847fc40e8b31fb4a043cc440455fca28b8f9a252271
MD5 02cb50dc6c2d8a0b158397dbb88364e6
SHA1 a47c3b438761d74f0b6f5881286578f4cecd24da
SHA512 62d87a1b097578e8c5807b5e993699962cedaf39d574bf22aa987ba723c782d139092860a049cbe5f1074926a11893fdfc7b8b8fa5b599a7f52dc1ca0e11d7e5
SSDEEP 3145728:Ise4/oxf03ZRozA76omzShIsS3sklyK6XllaG:44/YsOc6F6IsS8k81aG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  GDLauncher__2.0.9__win__x64.exe
- Size 111.3MB
- SHA256 42ad279878792b976f051847fc40e8b31fb4a043cc440455fca28b8f9a252271
- MD5 02cb50dc6c2d8a0b158397dbb88364e6
- SHA1 a47c3b438761d74f0b6f5881286578f4cecd24da
- SHA512 62d87a1b097578e8c5807b5e993699962cedaf39d574bf22aa987ba723c782d139092860a049cbe5f1074926a11893fdfc7b8b8fa5b599a7f52dc1ca0e11d7e5
- SSDEEP 3145728:Ise4/oxf03ZRozA76omzShIsS3sklyK6XllaG:44/YsOc6F6IsS8k81aG
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution spyware stealer
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  GDLauncher.exe
- Size 169.9MB
- SHA256 c8c3e212a56976e087a49d7fc5a007a9950c1b2b0426b5bf48e6ccec6ce7ae78
- MD5 f96c065714738a4008c9eebc4f0ccbb3
- SHA1 0461a73a7500bbaf033dcc308d29d8968891388f
- SHA512 a3584d8d2a87870523a04a1aad8cc9d1aa388305650558621e3808fdf5a0bc26b55cba684a87084fc3989e47a8812b73d359e0e04e9bdea352c488d0422b8fcc
- SSDEEP 1572864:es+fxQiW1vVzbHpUcEtmLd7cF3PPHNzLuTe7ulsxM/Gyr/w7VoB4X+x2CFRXQQSz:ze8BWNg3DFxfw
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution spyware stealer
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 6daa3cd398e5380222c6b6bdb4d66a4b4273d4bb74d6bf53495a5722f03ac0dc
- MD5 fcb299831276a7c8bdeb036142da1c25
- SHA1 bf6990abb92ab627b7f2e7aecbd5a58b86d2e09a
- SHA512 1e31ac0b6836d24488e32d04b5028ac2a9e00ebd8e29aaf742d9e0cdb50d5a9d4f7bcc3919b22a793552d31aaed2104415268f14e903754bf25a86510fbc98c9
- SSDEEP 24576:RQQa6NA6P5dWWSmwRFXe1vmfpV6k626D6b62vCuApj:RWfTF0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 760849cbcac0c4f59196c7354ee3feb0a4b6797f4b5ebd62b4ddd814b6cbf94e
- MD5 f66026445e6279173f4898cbff82edfe
- SHA1 35b9becd51883713754f2b7a5fe35a33a19cc78b
- SHA512 25264b1c945935c9658d0c6a355640734e9f9d9a01a27519c5566325a1b8474b465e4840744912e7ba1f8996ab4a0cc861c9aef1d3137200612447d124930f4f
- SSDEEP 49152:BCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNe:IG2QCwmHPnog/pzHAo/A6b
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 41d10a6d4c2736441b48676314b17e48846bb98d58a916cf8c4c2fd2753f2f2a
- MD5 5fc5b73483989f356c990f000a6ca954
- SHA1 0fd2ef2f2873da6f4d11546637bb826ebd3d8eb7
- SHA512 50d69bf00c970a0ff508895a26e28adfeb81834f6b973f465a5f5f364793cc7181344af8a9602150583bd1307261d6b44e1d88b695e7c80fd9d996dc43f5ccb7
- SSDEEP 49152:zPDtyvMYqXiOamQ7NyjmnMDbG7OUx7n6mfu/oB7pweIcgsxqeUsn/uI:jSOqNIoQG7OUrd/xKsn/uI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 477KB
- SHA256 ea072ea9e82ffada6c2b284001210f4b76f5950f40d2bde841d8f32b75de5443
- MD5 049fcd4c117f559f25543daad8c978dc
- SHA1 c404714e3094859986f38efcfb32fbb58a7b743a
- SHA512 ca0f2a9c4f00d77e337f926b2920cb814537bce5083aa0b49b798e84fc0f2f0e4e45a6a9a4e2a84c1afbae1cecd4b270be22d5ba3094b837753f20b0ff137755
- SSDEEP 6144:8uF2DwTNCKxOUxcfDVTyKH/VbPGtWQAOWIBtuKYbu7DBv:TDCKsAcfDVjktWQAOWIubg5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 7.5MB
- SHA256 a8d45aeca2957aae2237665864f9653188962bd5c34f6b806497ddbcf386fc34
- MD5 b0d70ba06fbfd4f6a374d9466b9188ec
- SHA1 7c7e14f7bfbe4e53c1fd0fe3833a560bd890b823
- SHA512 d3500f5d580d69191bcf007e4039cbf0f0d4ff8c11d6cd01f8a22ecb3b73528cf5cbee12881b6a45fbcd130f34cbe10fca75af43a4237144ee2664671a1913dd
- SSDEEP 98304:ZYM1bKnyhXV3X4Nf/eW74heor1up6sDCpaXm3TVz:ZL1jlX4F7ivuyUCTVz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  owutility.dll
- Size 1.5MB
- SHA256 0e5cbf02be8cf9c2bf15bc6c85377227b6dbe6e9c09076944aaf0705d8e80a0a
- MD5 dc3a7e94e4ff005423566c0c6dc315cf
- SHA1 c10c692dc98b8987e3c6c42f07bdbfe0322765c6
- SHA512 45bb95fb1e39aaf092c3c178e55ad6329823dbf370334e3b92e6e3675e94f167f689a583d9af57430d4601511ddcaced3f7339088e58b80bafe19c9ac339fbb0
- SSDEEP 24576:pjjAyN7CbTB3Iu2VIMiFryCF9fLp34G5cdHSdslQ3m3oGch+XaxLaXpb:pjcyNeR3IuUIMiFLFpLp3z5cdgsvYFhA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
- Size 7.3MB
- SHA256 e2c7d3b63e837a4d89cc9e247b8bf3c404cc85c967d43da4c27e92d2c09d416d
- MD5 d2dfca1c628015ab94ada595b3f29945
- SHA1 650541ed0a93c85f787957499eb76f12f5668262
- SHA512 0e2df55d141d685cd93882635fcf33d51636194092b2dfad4eb1e05366e306cfc1e486bd92c1b7abd3c06b6530df1d7585fb26daff1cf0543e630bedeac87851
- SSDEEP 98304:XK/JXOfs1oY6qWAIhUzgtDZhyfstGwAxDujtC3wdHErg7eYSG8G+PS:a/O/5DZteZu2wdHErgURG+PS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  resources/binaries/core_module.exe
- Size 26.1MB
- SHA256 59170447cf1e7e758ad6f54b6a8982316de21cfebb543c35f61347ab08c8ee24
- MD5 d78b9a9a820c9f39dcacf6756d8ef5ce
- SHA1 0cfe541a6ac9e1fc6153fa3c9fa11b70c2210b0d
- SHA512 14d7a9ffdfa861cf3c2366980ec63496e285ed7f897719ada5f486df766b7a2352297f40529ff5534167be57f54a8d15902a4171fe07467696c98655fc1aa3d4
- SSDEEP 196608:0rmuXNYaqEB5T6OBvFsaHHfEVd/munw9val:um6WEB5X7EVd/muOval
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Drops file in System32 directory
behavioral26 behavioral27
- Target
  resources/elevate.exe
- Size 115KB
- SHA256 939a5e8ac7b0251d7f8cc37370e7409b1091aa28b91d061bf78883f78be05d69
- MD5 d53dfeeb4d0e73a3f7ad0eafc96da9b2
- SHA1 b24cafd25092b94e133c0e4ed515ab3854244a6a
- SHA512 2fc6926dd8132f8a0d7244a69e86bf37ca12ba33e9136c6e99a1c81233c0a5b790499e6e144afbbd9513912dee5d3f314c1cd33d8707d1ed78a991363c56c618
- SSDEEP 3072:labLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl8X:sPrwRhte1XsE1li
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28 behavioral29
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 ab1a7f53d6a55a311ee6daf8c396ede9908a01fa014d891a2eb05bf5977acf51
- MD5 31322799446e60785a3d0d3c2c3232b8
- SHA1 730aebd7f83dd711dc263cbf4aea06a082cae75f
- SHA512 f45a3cfc254e8ff43e5e1de9e5af0cc09d8f1a3f32c9d62831f5fcb34ca201fddaabd05063cd87314962e4359a865a168522cecad1a640be0d4f8c1d0d2755ec
- SSDEEP 49152:GO6ftEjL3Zdon2+a/EgBqB1y91lxfAV7xWV9cO6NZ8m8xg1drRXmVEZvMUn0Hjyu:GLftlUSot6EmXxZdIOl5bzLB3dIW2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30 behavioral31
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 77d0df2de42a77b936c155e701ed6a98a8efa0e7b9dc710f95384da20635aaad
- MD5 cc8d44b42069f6fcf2d87cdf5addef0e
- SHA1 eae8a663198b991c1f7deeed63b3bfd795e26ac1
- SHA512 5db36695451a484debb276597d0d5d1b5a532b26324026f34ca7ef7b2aa958a228ecfc104b759d9a1a09bc64ead00935b5c73089d0e4d183ea94ae4fcca61bad
- SSDEEP 24576:Yy+lCO+5ian96u6WbEJXay6Z5WdDYsH26g3P0zAk7o3uv:YymViaWbYT6Z5WdDYsH26g3P0zAk7ou
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies file permissions

Reads user/profile data of web browsers

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

Modifies file permissions

Reads user/profile data of web browsers

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32