Overview

overview

7

Static

static

3

mev_bot Se....0.exe

windows7-x64

7

mev_bot Se....0.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSE.electron.txt

windows7-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows7-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

icudtl.dat

windows7-x64

3

icudtl.dat

windows10-2004-x64

3

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

locales/en-US.pak

windows7-x64

3

locales/en-US.pak

windows10-2004-x64

3

mev_bot.exe

windows7-x64

1

mev_bot.exe

windows10-2004-x64

7

resources.pak

windows7-x64

3

Resubmissions

29/06/2024, 22:21

240629-19544s1epm 7

29/06/2024, 22:13

240629-145amaxfjc 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mev_bot Setup 4.4.0.exe

  • Size

    78.0MB

  • Sample

    240629-19544s1epm

  • MD5

    e74c3ace03f86d3f02a2c5037a29bb68

  • SHA1

    5841f95f193810dda1b248ce624cc6e452e867cb

  • SHA256

    88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b

  • SHA512

    4dbe633581469ad6dc937306fe7391041e05dcb0d2fb6e722c965c370f7a632bce8f3aa7ca801b2560203931828f808109b5ff59f44a35090e20f831e51f1a6c

  • SSDEEP

    1572864:/K+e4h7/tXtQk+MK7GZsW3nKW1j4GDnz26eSGyENu2REomzBPXY1oSR:/be4TWk+MK7usW3n14GDz26tGyGBREol

Score
7/10
discovery

Malware Config

Targets

    • Target

      mev_bot Setup 4.4.0.exe

    • Size

      78.0MB

    • MD5

      e74c3ace03f86d3f02a2c5037a29bb68

    • SHA1

      5841f95f193810dda1b248ce624cc6e452e867cb

    • SHA256

      88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b

    • SHA512

      4dbe633581469ad6dc937306fe7391041e05dcb0d2fb6e722c965c370f7a632bce8f3aa7ca801b2560203931828f808109b5ff59f44a35090e20f831e51f1a6c

    • SSDEEP

      1572864:/K+e4h7/tXtQk+MK7GZsW3nKW1j4GDnz26eSGyENu2REomzBPXY1oSR:/be4TWk+MK7usW3n14GDz26tGyGBREol

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral10behavioral9

    • Target

      LICENSE.electron.txt

    • Size

      1KB

    • MD5

      4d42118d35941e0f664dddbd83f633c5

    • SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    • SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    • SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    Score
    1/10
    behavioral11behavioral12

    • Target

      LICENSES.chromium.html

    • Size

      8.8MB

    • MD5

      2675b30d524b6c79b6cee41af86fc619

    • SHA1

      407716c1bb83c211bcb51efbbcb6bf2ef1664e5b

    • SHA256

      6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

    • SHA512

      3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485

    • SSDEEP

      24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

    Score
    1/10
    behavioral13behavioral14

    • Target

      chrome_100_percent.pak

    • Size

      132KB

    • MD5

      a0e681fdd4613e0fff6fb8bf33a00ef1

    • SHA1

      6789bacfe0b244ab6872bd3acc1e92030276011e

    • SHA256

      86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2

    • SHA512

      6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196

    • SSDEEP

      3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ

    Score
    3/10
    behavioral15behavioral16

    • Target

      chrome_200_percent.pak

    • Size

      190KB

    • MD5

      c37bd7a6b677a37313b7ecc4ff01b6f5

    • SHA1

      79db970c44347bd3566cefb6cabd1995e8e173df

    • SHA256

      8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a

    • SHA512

      a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb

    • SSDEEP

      3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR

    Score
    3/10
    behavioral17behavioral18

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      2191e768cc2e19009dad20dc999135a3

    • SHA1

      f49a46ba0e954e657aaed1c9019a53d194272b6a

    • SHA256

      7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    • SHA512

      5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

    • SSDEEP

      49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

    Score
    1/10
    behavioral19

    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      51f1baa7fee261d4a7d7f188c0cf7502

    • SHA1

      ad414b2046101e49b5c74d2cac96be782f50570c

    • SHA256

      4218ee7a02556cf4a925f79957e3e157c54ef236a22208464406c88031695f1b

    • SHA512

      b9ca5d7bfff98c07c7ffafade7e3cb3da0c7dc63bb2ff4e8da3223ddb46a9e972fa3540ab86bb4c2e2309966af38cb5572f8f4bd54c8528a4c36789773a8a98c

    • SSDEEP

      49152:6F5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQNSCu:6FvSkJXv+tiLAD0+DNS5

    Score
    1/10
    behavioral20behavioral21

    • Target

      icudtl.dat

    • Size

      10.2MB

    • MD5

      e0f1ad85c0933ecce2e003a2c59ae726

    • SHA1

      a8539fc5a233558edfa264a34f7af6187c3f0d4f

    • SHA256

      f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

    • SHA512

      714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

    • SSDEEP

      196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I

    Score
    3/10
    behavioral22behavioral23

    • Target

      libEGL.dll

    • Size

      477KB

    • MD5

      24d21aafc8df659211ef982beb29c2f0

    • SHA1

      7196fc5dd9a4cfcb5c828d86bc333f422e1e3587

    • SHA256

      d421431e5390d9e1a9f3d75c987d8cb73bb47e81208f0320bda1a945dede8939

    • SHA512

      a6f1f5435be3bf37aebd8060d258a1e4c09b467d26034fdc7b2b1d3e63cba0e03f7ab733f616616708e0f4efd2aae9aef8d191c7beebdeb71e5ca6792a6fbd2c

    • SSDEEP

      6144:S8hd1BSjuMmof2SEXVVfgV8hxN7h2N0IEOg51f0FticyQ:S8DXSjZmof2SEsmN12N0IE7f0FticyQ

    Score
    1/10
    behavioral24behavioral25

    • Target

      libGLESv2.dll

    • Size

      7.3MB

    • MD5

      b62eda9bcf73a1205eba62ba1e58dfed

    • SHA1

      a8663b78fb7897acaba6e6e73d1e1c00b0a8b7fc

    • SHA256

      6572e621800f308de46fc60b5a615e015119410d3f1c260ce1750e4de81e91d1

    • SHA512

      42d1f4f1e3762060869933a9c3b6176650579a20238097c52c7d6a9904f01ce327527c0607cf9a00c7b66944c1461975c15aa6fca18e0ce4703a5fd99ba2fadf

    • SSDEEP

      98304:+nbalIu/BrsXHXnvV9AcDoyGDHnSHQZ3rW:+nGG0BMXBDerr

    Score
    1/10
    behavioral26behavioral27

    • Target

      locales/en-US.pak

    • Size

      411KB

    • MD5

      626f30cfd9ad7b7c628c6a859e4013bd

    • SHA1

      02e9a759c745a984b5f39223fab5be9b5ec3d5a7

    • SHA256

      0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de

    • SHA512

      9ce902f21fef70c5b5af444b532b36c9a00d896878cb4021c9b1dc07aa3277d956bca65ee0adb68467eec113e535b60a8a5fb5414c7d0ca761ceae5c43b7d9a9

    • SSDEEP

      6144:MOoiE2KSqdBEuUu6/9meKMP9e7X9ifaY3yzq5J7SKn0F/lOSwH:n5EC2B4bKMwX9cj5hSwSwH

    Score
    3/10
    behavioral28behavioral29

    • Target

      mev_bot.exe

    • Size

      164.6MB

    • MD5

      93b7c6724e1fac653f1e184052b65bc3

    • SHA1

      ca8d7854d55d8a2d921f636c4cb23cde9a3cef8c

    • SHA256

      1c75ccba25ea5641f46cff6a4cfe7bc98ae37378a967aece88a778050c4059bb

    • SHA512

      5514d7c94059f88bdf7e092aa89116d01eb48f8b5acd050d569ee0d2328f334a9e6193206be41f3d541f87437d7264217a9260d260a5e02d22dc44c12ddde40c

    • SSDEEP

      1572864:2Y4kA9UxkJnpZ4yOkfXfFrkaLxi1iY501leioZ4etfn7Niqld7vZ7S8u2fZuV+5L:npyXqzRTLr

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral30behavioral31

    • Target

      resources.pak

    • Size

      5.2MB

    • MD5

      ecf9792c09b7084c8151c15307b48cc4

    • SHA1

      88fdd2b60cdf571a52a03abd794114bff720520c

    • SHA256

      947fb87beb5edfe3b33899e6df6961ddd1cba0734f8a1192eed4ca41276e9be8

    • SHA512

      716e378842888f6aef1122374324d03a00661238568f86db5af796c8ef4eb48005001df2cc4134f9d3e6e59f133b006e3f11d1fa619118e6f2925058d8449d8c

    • SSDEEP

      98304:5EPFNXMmWPVctFCZnSEVHYxh1Z/p6uNXrwrXRVunEVvXjNSfz3hIkrT7s:5EPFNXMddCMrIhz/xpkrX2nEVvXJAqkQ

    Score
    3/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks