Overview

overview

7

Static

static

3

FluffyPeng....9.exe

windows7-x64

7

FluffyPeng....9.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

FluffyPenguin.exe

windows7-x64

7

FluffyPenguin.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

d3dcompiler_47.dll

windows10-2004-x64

3

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

3

libGLESv2.dll

windows10-2004-x64

3

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

resources/...er.dll

windows7-x64

1

resources/...er.dll

windows10-2004-x64

1

swiftshade...GL.dll

windows7-x64

1

swiftshade...GL.dll

windows10-2004-x64

1

swiftshade...v2.dll

windows7-x64

1

swiftshade...v2.dll

windows10-2004-x64

1

vk_swiftshader.dll

windows7-x64

3

vk_swiftshader.dll

windows10-2004-x64

3

vulkan-1.dll

windows7-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    FluffyPenguin-Setup-1.5.9.exe
  • Size 120.5MB
  • Sample240613-dg5asasbpc
  • SHA256 c954ba4d9f8e230d8fd42b5fa0bd25bd978725b78b9473e23da4740cda0606c1
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Targets

    • Target
      FluffyPenguin-Setup-1.5.9.exe
    • Size 120.5MB
    • SHA256 c954ba4d9f8e230d8fd42b5fa0bd25bd978725b78b9473e23da4740cda0606c1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10behavioral9
    • Target
      FluffyPenguin.exe
    • Size 104.7MB
    • SHA256 ea6acec46bf0106d111cb0ca33a98150a651ebf4f762faf65b2ea40dd69e1f46
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12
    • Target
      LICENSES.chromium.html
    • Size 4.5MB
    • SHA256 03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      d3dcompiler_47.dll
    • Size 3.5MB
    • SHA256 2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15
    • Target
      ffmpeg.dll
    • Size 2.5MB
    • SHA256 81cab2e7ff56c8a06421419a2dac9481b87d5e50ef6f89a40e9de2d28d4998f2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16behavioral17
    • Target
      libEGL.dll
    • Size 358KB
    • SHA256 9322a0e0d0c8a8be035d29e581de402284ffba4d980806596dedbec7be8a08ca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18behavioral19
    • Target
      libGLESv2.dll
    • Size 6.3MB
    • SHA256 8b9571808714bcd01c3156c7cd254fad104797cbe1ff6c823677b713dcc352b2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral20behavioral21
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral22behavioral23
    • Target
      resources/plugins/pepflashplayer.dll
    • Size 17.5MB
    • SHA256 47e01f34945dabb0fa67578f058cb6a048414ecdb2145f601a40dc8d535b59b9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24behavioral25
    • Target
      swiftshader/libEGL.dll
    • Size 379KB
    • SHA256 74f934004b27fa48154876bba8710e301c75aa3d9125e6180c4486b139159801
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral26behavioral27
    • Target
      swiftshader/libGLESv2.dll
    • Size 2.7MB
    • SHA256 f3ed98d9c3e915b6c55bcb9a17e162134ce9897c5246110bc2955cac5851fe2a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28behavioral29
    • Target
      vk_swiftshader.dll
    • Size 3.7MB
    • SHA256 e481daf4a92f3b1e73ba4cd85546d561a21c214ef74bfedf9c8f87319857a83e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral30behavioral31
    • Target
      vulkan-1.dll
    • Size 624KB
    • SHA256 3e04a5ad696827a41891bb61befd845004a0d0816832a69f070716c16e621803
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks