13ed8672ba8f1fb7c2da5f71cd03045a0f5400050bb6ed664635858e11d03d28

General

Target
CALANI AIO CHECKER.exe
Size 14.6MB
Sample240616-x2ncjsxfpl
SHA256 13ed8672ba8f1fb7c2da5f71cd03045a0f5400050bb6ed664635858e11d03d28
MD5 86ad7a94051050bc2fb62ebbc75583a6
SHA1 18f7d9351a1e57003bf17a26a7cc17e67080def8
SHA512 dfade580ce90bb4feed4fc496aa1b7b28001b6110e14af2820fd4a8ad2a768271c0c9b663b19f0bf5f2a626fee4e2f8bdef510d5a16fe08f6444e909cff20d56
SSDEEP 393216:7X/fYvyjSZjkwsrWhoFK4prSev2M9EnMXtcC:7X/fY6W7eqo4irSHM9EnM9cC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

pyinstaller

Malware Config

Targets

- Target
  CALANI AIO CHECKER.exe
- Size 14.6MB
- SHA256 13ed8672ba8f1fb7c2da5f71cd03045a0f5400050bb6ed664635858e11d03d28
- MD5 86ad7a94051050bc2fb62ebbc75583a6
- SHA1 18f7d9351a1e57003bf17a26a7cc17e67080def8
- SHA512 dfade580ce90bb4feed4fc496aa1b7b28001b6110e14af2820fd4a8ad2a768271c0c9b663b19f0bf5f2a626fee4e2f8bdef510d5a16fe08f6444e909cff20d56
- SSDEEP 393216:7X/fYvyjSZjkwsrWhoFK4prSev2M9EnMXtcC:7X/fY6W7eqo4irSHM9EnM9cC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

pyinstaller
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2
- Target
  Calani-AIO-v1.0.4-windows_x64.exe
- Size 14.8MB
- SHA256 22ea372f8259e913bd62808a8651f16e3e576cb08dce509382631de36925c961
- MD5 e7b5e8b5e8069760a36fa07ce62b046e
- SHA1 cc6707e38d6c55f6f4f638efb61540a73415a410
- SHA512 e9a28995fc3dd7d1bb9f85af6fd5f5807d279d8ec3e9bb5007b8563369ddfccbe90ec0e7fcaacefc9d06f05ef1e21867101c9408562e429657c2f4335d516d84
- SSDEEP 393216:YqdQuslN/m3pqq9AJ4Yq3+d9VPV4aX49W8wi8/cwR:YqdQu4KhS4POd9ZF49W8wi8/hR
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  Client.exe
- Size 56KB
- SHA256 2cf97c4877560500eae54191bbbcd1aaf0419d96f6423786a51be619b5b3077b
- MD5 07a9889aae843dd11665bdc9bf8b62dc
- SHA1 73ff6c4d0cf4366ec31516fa601aa1ee74afff38
- SHA512 0f780ae7dfa5a90f708aebcda7b9e832a90b4b566493a90977371c62385c1f6de401d32cb0bc2b272e16a803478d33da04ce57521f63bc5b4469e6f1463c5e0c
- SSDEEP 768:Zdiv4Kbwg2V+YV5XfADYI1WQZvnqLMh0AoE7pwaambG4lRxxX93zhXIdT:Z+bwsfqLzECafbX3xB9jpIdT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6