56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Sharing

Copy URL

Twitter E-mail

General

Target

Feather Launcher Setup 1.6.1.exe
Size

104.6MB
Sample

240703-fkw5paybrb
MD5

3a201dabfdaff24a8c208b11049e276d
SHA1

c19478d565e5d3e41347aa65e8cb4b66b31a05f8
SHA256

56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126
SHA512

88a769b8587e8f4ca00546ebd21a976349a2532dde0bca6418f07e56d0a6e2b26c451a379b1ff0b5ffc5448e0d0f5e1c72e7821b3ea5cb0f4e07cf8497112472
SSDEEP

3145728:mkQEzg2K6FiBz+GBTRJmgm0Iiy+FO7Ahhq60XYJMP2ZW:mw26YzlggmtB7Ahh9mxeW

Score

6^/10

discovery persistence

Malware Config

Targets

- Target
  
  Feather Launcher Setup 1.6.1.exe
- Size
  
  104.6MB
- MD5
  
  3a201dabfdaff24a8c208b11049e276d
- SHA1
  
  c19478d565e5d3e41347aa65e8cb4b66b31a05f8
- SHA256
  
  56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126
- SHA512
  
  88a769b8587e8f4ca00546ebd21a976349a2532dde0bca6418f07e56d0a6e2b26c451a379b1ff0b5ffc5448e0d0f5e1c72e7821b3ea5cb0f4e07cf8497112472
- SSDEEP
  
  3145728:mkQEzg2K6FiBz+GBTRJmgm0Iiy+FO7Ahhq60XYJMP2ZW:mw26YzlggmtB7Ahh9mxeW
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/VC_redist.x64.exe
- Size
  
  491KB
- MD5
  
  fabcfa9eb3c975cb34c6a0220be8f363
- SHA1
  
  c663cab1088bcffc42ec1b802c94b5b48b128d81
- SHA256
  
  d04f82b53c09558ee01f2746de0991f9417bed9a0b820da0538e08f9b000a95e
- SHA512
  
  97bf954b0f2beb8e3be64af40e5e4707f95b82d9fa5a476cde318cc0f3e96dc39f7005cf673884b83a41a2dcf8e643448c47e02d7ac066c726bb3cade9243213
- SSDEEP
  
  12288:+nMwHskY7gjcjhVIEhqgM7bWvcsi6aV/rIy0U40vy:YMysZgjS1hqgSC/izDfvjy
Score

1^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/app-64.7z
- Size
  
  73.3MB
- MD5
  
  74c664e89ef71d4c3a8c2acb7f966f77
- SHA1
  
  423da23025d1a558b857695c9dc83161d9027841
- SHA256
  
  f61d9d8bf330c98ccc33e6c73ff38aafd9767a51e43258c35058fb96e4e3399d
- SHA512
  
  aa0ee334ead4629e317517b7112de6547caf96f27ed2f2c77a2aa97f65b7c3c4c6c0b3467a0e894d9753e071b38f69e3c8fbdc4411e6ddd1625359d06effa39b
- SSDEEP
  
  1572864:+QETnfgfbqT2V6mOKBBzx3k9wzdDvRPB15Oex/wt0cLi+nlUDAB:+QEzg2K6FiBz+GBTRJmgm0IiyB
Score

3^/10
behavioral13 behavioral14
- Target
  
  LICENSE.electron.txt
- Size
  
  1KB
- MD5
  
  4d42118d35941e0f664dddbd83f633c5
- SHA1
  
  2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA256
  
  5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- SHA512
  
  3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
Score

1^/10
behavioral15 behavioral16
- Target
  
  chrome_100_percent.pak
- Size
  
  126KB
- MD5
  
  a3d4515d3a33a407d313a62818e82a5d
- SHA1
  
  967ff9a6774a66f7b3299af4fd5d70961ed54d79
- SHA256
  
  662a9db6ef4197cb4b6c50648a2cafceb7fd903015828df3fee605a602370be0
- SHA512
  
  0c757e1beccbca1ae0791fa0c51a9e2019696bd0965c73de67b364fba6f317ea2cf20fa65e4fa7dd22519683528e5112dc8c530049170f4e702e0c8d4e065801
- SSDEEP
  
  3072:KKzwqCT4wKN3/nXCWZQCPxBVO2o418Gb0+VRLf0ld0GY3cQ39Vm2I:KKzwt49NPyCtoK18Gb0OV8ld0GecQ3f2
Score

3^/10
behavioral17 behavioral18
- Target
  
  chrome_200_percent.pak
- Size
  
  175KB
- MD5
  
  3bab45c70f22646cf8452c30903810cb
- SHA1
  
  40b31d4c79b5a2b8d12f8cf8b6c49c962c31f766
- SHA256
  
  d4282ae977f23afe252e19e421c8d09696ea3b83a1e73a6aaebaaa5547c74cbc
- SHA512
  
  85eda055494f0233c963e821906cf69d94e664d8396e8b08e7a8f412e1c16af71252fef1bfe3ed43cfad157aa90c0dcbb375626e2ddf0e807c9b23ad27e61d9c
- SSDEEP
  
  3072:9sDQYaEQN6AJP1N3/nXCWZQCPxBVrfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+9:SDQYaNN681NPyCt9gx5GMRejnbdZnVEd
Score

3^/10
behavioral19 behavioral20
- Target
  
  icudtl.dat
- Size
  
  10.0MB
- MD5
  
  6690f2b2384e1bf8961fda96a4d07691
- SHA1
  
  111f6dd9833c653908431621fe8fbc87f1135632
- SHA256
  
  cb73d42d36839708013393ad0e4e932fdda9a1acda9275ecdbe74fe89eea8366
- SHA512
  
  6a5242fdc0ba09e339151feae1b3f7a9f00a09288b6f4ea9305d1a09d8bc3015c074ee91de35b8d6fc765c2fb55ec37dd91b8e66b7a7bb3148cbc305de19b088
- SSDEEP
  
  196608:GTzwSv9AAyM0agliXUxCGZHa93Whlw6ZRiZ/:GoKlyMqliXUxCGZHa93Whlw6ZRiZ
Score

3^/10
behavioral21 behavioral22
- Target
  
  locales/af.pak
- Size
  
  321KB
- MD5
  
  3ab2fcf223a5fefe8a186741b3507e14
- SHA1
  
  9e851c09c08415a228fad02ba87a9caeb29e3b9b
- SHA256
  
  e6db19247e92d007323f9e0ee776c423a6a8a64ab321c9d5c964cf137e390a4d
- SHA512
  
  c1259f7953191b7c89694d826f4e45564d4c7b6be2aa7e85b73c5a6f723894b139ba62d215def008f45a95215fb3da7463e229c8ed014a6db4b03e64133891e9
- SSDEEP
  
  6144:KbzCIQTkrIWlr5J9e5D4oEa/kQjB6KAxborgjXgxzsB+xSk1yMx65tHwDwzl2i3s:004r5lr5Jfha8QjB6KAxborgjXgRVSkn
Score

3^/10
behavioral23 behavioral24
- Target
  
  locales/am.pak
- Size
  
  519KB
- MD5
  
  1ef5cb04c40f553fad6dd74295ff4588
- SHA1
  
  9065653dc4ec508b657fb86f45a69114d1ab4be1
- SHA256
  
  9aa0bee97cd6957d3fa1dc43e3bc45b7fc4f55df6df9a33faa7aeaf6e2c46a71
- SHA512
  
  fe766d0841a1a247442e85b5e4890fd3f83c76686e61c2243ed93a373d7c4b9a79558200583e58fb17cfa64efe053d61c582d83beb078a62ef232376e4741ead
- SSDEEP
  
  12288:NYnfumzy8xVxKaPYw5Q90nFuTbQYx30jH8+Y:G3y8xVxKsYw5Q90nibQ0
Score

3^/10
behavioral25 behavioral26
- Target
  
  locales/ar.pak
- Size
  
  561KB
- MD5
  
  f27d0b588bfb76f541e9a8d83c74fc58
- SHA1
  
  23d01bdf7e1a7d9cc34a53b5d0e9a221395d0f67
- SHA256
  
  88645be62d0421ace7b2c44df7de67a4a83b04977049bef82b465f60f06d5560
- SHA512
  
  9406a3150e40a5c93c9a2ba82030b334161273ec3d66c8812cb7328340cafd0ce549f178cddcd00bfc227a258e8aba64305be203fb6502fd87f76f224d0a7126
- SSDEEP
  
  12288:gFMEKqWAjXji/HscvYUB5bsHX15sNb2+qTdpvMgSEN1y:7xyHl5N+9
Score

3^/10
behavioral27 behavioral28
- Target
  
  locales/bg.pak
- Size
  
  596KB
- MD5
  
  d9291d2f1e816471f691f37c5a4635a0
- SHA1
  
  201f26fff690b95f559d57866d7db519364ac27e
- SHA256
  
  4a7d229dbd7ca53bac0438d5705a8ecad9e33213f6752e58624da1b9e9cd571b
- SHA512
  
  074b46011bed5750dd49ec5e021b02850d11b235730c27bc2d0910a69f2f1d03c79dbe692b5dc34b7be28ab071b8af6c639151ebb10364f04b8acf4615c54270
- SSDEEP
  
  12288:w+DfVlY9dAs1aKUDpgaVVwsP86vmF0Z3SKN3YCcbIynMxJfu64K2zruSZpkVqU55:w+D9lY9dAs1aKUFAs0EZ3SKG/vMvu6p9
Score

3^/10
behavioral29 behavioral30
- Target
  
  locales/bn.pak
- Size
  
  765KB
- MD5
  
  bc688ba7dd2b0f9946ac98a1df15131f
- SHA1
  
  b453ec6785191b3dbd5d78e7b25b9481b6522b32
- SHA256
  
  6ad844d2b22c8fbf3587ea603140deb1475dab934ac62e402dbf1c6946dc882e
- SHA512
  
  3d60102975a6acb39ad5f750128ab4967bdb5a64eeb398c5fc71e5fcca860eb97487df4e85269a5ffdc1f030bae2ff1c03d61b08565792f84696693aef8119ba
- SSDEEP
  
  3072:PnsmuG+M6YiWRQGbMzkoBbLN7SG5zwXl9M:Pv+gvRlbMzBbLB54lm
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32