df845c415d0b6fd996199562ffc7fd2a96b0cf1e4eb36da1be927edee3815c74

Sharing

Copy URL Twitter E-mail

General

Target

jan-win-x64-0.5.0.exe
Size

136.9MB
Sample

240624-crvcwsvdnf
MD5

bdc284e6914774716a047981553ad57d
SHA1

ea6ebbffdf3f9ae1d84be223d3a2524ad11aa46c
SHA256

df845c415d0b6fd996199562ffc7fd2a96b0cf1e4eb36da1be927edee3815c74
SHA512

fd21e1c6f56cd715c040646828bfdeb94aa0b8a74ba01bd35291329f6dca40a4c969cc06e01986709376d608bdd154c90ffb12a030c1141c3694fe3ba5578060
SSDEEP

3145728:SdTm4qvkkmGb+m+8EA37WdP3gQPt7bY+wMOM0RN/d0xVo+2OwQ:qC4qsob+m+85rWd3gQ9bTwa4N/6uOX

Score

9^/10

Malware Config

Targets

- Target
  
  jan-win-x64-0.5.0.exe
- Size
  
  136.9MB
- MD5
  
  bdc284e6914774716a047981553ad57d
- SHA1
  
  ea6ebbffdf3f9ae1d84be223d3a2524ad11aa46c
- SHA256
  
  df845c415d0b6fd996199562ffc7fd2a96b0cf1e4eb36da1be927edee3815c74
- SHA512
  
  fd21e1c6f56cd715c040646828bfdeb94aa0b8a74ba01bd35291329f6dca40a4c969cc06e01986709376d608bdd154c90ffb12a030c1141c3694fe3ba5578060
- SSDEEP
  
  3145728:SdTm4qvkkmGb+m+8EA37WdP3gQPt7bY+wMOM0RN/d0xVo+2OwQ:qC4qsob+m+85rWd3gQ9bTwa4N/6uOX
Score

9^/10

discovery ransomware
- Renames multiple (4412) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  Jan.exe
- Size
  
  168.8MB
- MD5
  
  986557a3eeebca6ba416d8d49a660904
- SHA1
  
  4a5825b37007c305671db68c22db0c9be13fc713
- SHA256
  
  331d49f470bfc31296db4ec291cc4e82e3b7f4a51503fb39013c2cabe3d496b7
- SHA512
  
  4b927790f1de21fae4614b61918b3fcf712964a0b2ad0ed0ff02321a8f57e1848cc039faeb807ec88051726cb878ac37bde337baad1943a7dc80ed8fb9a3b733
- SSDEEP
  
  1572864:THHt7MS+5eN4KyKpaRpOxS/krGAbJr3OIrMrpA98836lPCXg+ir70aDmyEgiAKLj:zZMzBOBylarv
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  
  LICENSES.chromium.html
- Size
  
  9.8MB
- MD5
  
  b620990ddbd932d6475152e5a833860e
- SHA1
  
  70de0b3d7ffa77900f685c1788b32997a61ec386
- SHA256
  
  921452a09f92f10da4cfef0521acd6ee6c689c630661ed35189e793de2c99fc5
- SHA512
  
  ba84b5e6281dd64d5da41d0db35942b6c0b1ee6b47d24dedd5006be40b2d22d90f58dc653e17893347900fb1bfcd37b0f2fff5b532175ccacc3b63d98fe42ac7
- SSDEEP
  
  24576:K+QQM6Ms6x5d1n+wRhXe1BmfEl6k6T6W6b6f6V6GeGj/3BIpx:LUcBeGdY
Score

1^/10
behavioral12 behavioral13
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  a7b7470c347f84365ffe1b2072b4f95c
- SHA1
  
  57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA256
  
  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- SHA512
  
  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP
  
  49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score

1^/10
behavioral14
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  1268e3c8fe56351c438de7e3e1af1e62
- SHA1
  
  be1c096c70aa2fc848b4217bbc2def1003c94485
- SHA256
  
  c624147af5b16c2d7293fe54f13d11540c5b0572f5976c3ed90b49b23448d0ce
- SHA512
  
  f230cda66bce2146c54a935b5a30b43ca768945c4fb3c584f912f82147b0a1ca08725859b62b5e8a2ce69dcf3793f8af2eb6985c3f8c6028402675a52eabfac5
- SSDEEP
  
  49152:BC8lp7/1UNZrhOP9YJQHUOWwGen6yfW0OfShPdb5x:ehOVYJiUOWwQaPB
Score

1^/10
behavioral15
- Target
  
  resources/app.asar.unpacked/docs/openapi/jan.yaml
- Size
  
  32KB
- MD5
  
  d1671d18dd727fd515055443f71aa5ef
- SHA1
  
  c0366ce5fb6bb33f4e883176c74ec7dc108efc66
- SHA256
  
  98dbde043a0d3eb3c35a8759c94a0598b6743729c740bf9f5c0e36da9a47c325
- SHA512
  
  dafe23b8f77aa71608961971701a99e308db3f1641a6dc25def71f1e5b4464895e8bfba4dcfacc4ae27f1cea36e5784ef6f9b909bff78e9fb59d1649bf4ec26e
- SSDEEP
  
  384:yLipDVsnsb0EDUxlv6bUmSwUmUzBUpUtky6LvS0JUFUFp//6aUIyO05peGBnH6vo:3ppsnsb5DWlSbBpVuBcDLvSUku8Jsof
Score

3^/10

execution
behavioral16 behavioral17
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/api-ms-win-crt-heap-l1-1-0.dll
- Size
  
  19KB
- MD5
  
  28579ca40c9e19cc6dc23dfb8b6871cd
- SHA1
  
  804cdccdb65ad15e016072b5d6f9843096140864
- SHA256
  
  a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4
- SHA512
  
  9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c
- SSDEEP
  
  384:7Y3e9WPhW8snhi00GftpBj1Aemwl1ILUI:PqMnhoivAeSoI
Score

1^/10
behavioral18
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/api-ms-win-crt-runtime-l1-1-0.dll
- Size
  
  21KB
- MD5
  
  f576fd38085005b4ab2ff1dacd293c48
- SHA1
  
  75074cfc7543b34f0bcace916370413055dee2ae
- SHA256
  
  6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582
- SHA512
  
  3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25
- SSDEEP
  
  192:AtIPrpJhhf4AN5/KiJWIghWGQ9u7B123Ouo+Uggs/nGfe4pBjSPYf1TDBRzIWh0d:AtYr7fWPhWkTi00GftpBjtCemlNdlgC
Score

1^/10
behavioral19
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/api-ms-win-crt-string-l1-1-0.dll
- Size
  
  24KB
- MD5
  
  e730cd977ac7f60f0824775e39c8fd2c
- SHA1
  
  fdfaf759a360293687bd2838b7d9feb628edaf5b
- SHA256
  
  63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31
- SHA512
  
  d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8
- SSDEEP
  
  768:16S5yguNvZ5VQgx3SbwA71IkFvsoi9eedilK:1l5yguNvZ5VQgx3SbwA71IYsomdb
Score

1^/10
behavioral20
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/libnut.node
- Size
  
  158KB
- MD5
  
  f1ef6ad804808711cb05370fc5b0a649
- SHA1
  
  023c897e79de350e48febac0e681cf5a4abe6e2d
- SHA256
  
  71fcda3642d004d849be83895b0480cfb91b419b16c16934af67c2496934576f
- SHA512
  
  f378d90c078780cb643e2e119e316cfd5250091fc7e631c1716e47d5b62c8be53739c2a1644e1808796f079d87a5ae9b07d95e7da9fcdd03df7175353e6106c4
- SSDEEP
  
  3072:I7ZYbFAn/n9ruTE3KcwcW+vsL9dR69VNFRiwC7D93ZAef+x:Iqbi/VsMKcfW+Gf+x
Score

1^/10
behavioral21 behavioral22
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/msvcp140.dll
- Size
  
  618KB
- MD5
  
  9ff712c25312821b8aec84c4f8782a34
- SHA1
  
  1a7a250d92a59c3af72a9573cffec2fcfa525f33
- SHA256
  
  517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094
- SHA512
  
  5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33
- SSDEEP
  
  12288:eNQSZJrC30ovvjPo9E/YZt4QEKZm+jWodEEV2qwcg5MpccRwLM:0Z2jPo96QEKZm+jWodEEYqwcg5Mpck9
Score

1^/10
behavioral23 behavioral24
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/vcruntime140.dll
- Size
  
  85KB
- MD5
  
  edf9d5c18111d82cf10ec99f6afa6b47
- SHA1
  
  d247f5b9d4d3061e3d421e0e623595aa40d9493c
- SHA256
  
  d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb
- SHA512
  
  bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf
- SSDEEP
  
  1536:6iOTTyN9d/mqN5fomseOpLZ5UP4nlf9ecbtGgcvg9EBIN:6DIVzgx5UAecbt4g9EuN
Score

1^/10
behavioral25 behavioral26
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/build/Release/vcruntime140_1.dll
- Size
  
  37KB
- MD5
  
  75e78e4bf561031d39f86143753400ff
- SHA1
  
  324c2a99e39f8992459495182677e91656a05206
- SHA256
  
  1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
- SHA512
  
  ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
- SSDEEP
  
  768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
Score

1^/10
behavioral27 behavioral28
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/index.js
- Size
  
  1KB
- MD5
  
  175dfac5e8b77d7746f8fea1ba5996b0
- SHA1
  
  44aad53517b2585e82a4f90b4e2394fd20cb16c5
- SHA256
  
  7e21853515f1d433b242d5a11a1b038ab1dcb5ef3f53c8986e600c1501e372d5
- SHA512
  
  aa01e52aa8ea3a330199c8f62de27be7bdb3161142d16ea3e2356accfc00dfd937c27fc7dd7a6a90b26de1ff5dfa38f1cd5502432f634e49379601ccf6641010
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  resources/app.asar.unpacked/node_modules/@kirillvakalov/nut-tree__libnut-win32/patch-packagename.js
- Size
  
  539B
- MD5
  
  db2737cd8ee199ce63251a00d532d7f5
- SHA1
  
  539776647c55f95b4828e7ef43b42c17e08d8111
- SHA256
  
  ef92ea78bcd39cee1d5ef0828336e7955e3f6b9d1a0a29bea7552369be1feb54
- SHA512
  
  730c69604f085519e87a7272520dca092d00b24f7ee4e5b40875ae5696666ace75e493cae3f84f1d29722c2b871d9fba0ce2349754347b44e490276a9512ed4c
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Renames multiple (4412) files with added filename extension

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32