Overview

overview

7

Static

static

3

mev_bot Se....0.exe

windows7-x64

7

mev_bot Se....0.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSE.electron.txt

windows7-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows7-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

icudtl.dat

windows7-x64

3

icudtl.dat

windows10-2004-x64

3

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

locales/en-US.pak

windows7-x64

3

locales/en-US.pak

windows10-2004-x64

3

mev_bot.exe

windows7-x64

1

mev_bot.exe

windows10-2004-x64

7

resources.pak

windows7-x64

3

Resubmissions

29/06/2024, 22:21

240629-19544s1epm7

29/06/2024, 22:13

240629-145amaxfjc7

Sharing

Copy URL Twitter E-mail

General

  • Target
    mev_bot Setup 4.4.0.exe
  • Size 78.0MB
  • Sample240629-19544s1epm
  • SHA256 88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Targets

    • Target
      mev_bot Setup 4.4.0.exe
    • Size 78.0MB
    • SHA256 88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10behavioral9
    • Target
      LICENSE.electron.txt
    • Size 1KB
    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral11behavioral12
    • Target
      LICENSES.chromium.html
    • Size 8.8MB
    • SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      chrome_100_percent.pak
    • Size 132KB
    • SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral15behavioral16
    • Target
      chrome_200_percent.pak
    • Size 190KB
    • SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral17behavioral18
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      ffmpeg.dll
    • Size 2.8MB
    • SHA256 4218ee7a02556cf4a925f79957e3e157c54ef236a22208464406c88031695f1b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral20behavioral21
    • Target
      icudtl.dat
    • Size 10.2MB
    • SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral22behavioral23
    • Target
      libEGL.dll
    • Size 477KB
    • SHA256 d421431e5390d9e1a9f3d75c987d8cb73bb47e81208f0320bda1a945dede8939
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24behavioral25
    • Target
      libGLESv2.dll
    • Size 7.3MB
    • SHA256 6572e621800f308de46fc60b5a615e015119410d3f1c260ce1750e4de81e91d1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral26behavioral27
    • Target
      locales/en-US.pak
    • Size 411KB
    • SHA256 0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral28behavioral29
    • Target
      mev_bot.exe
    • Size 164.6MB
    • SHA256 1c75ccba25ea5641f46cff6a4cfe7bc98ae37378a967aece88a778050c4059bb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral30behavioral31
    • Target
      resources.pak
    • Size 5.2MB
    • SHA256 947fb87beb5edfe3b33899e6df6961ddd1cba0734f8a1192eed4ca41276e9be8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks