538625f9a7445060633674211aa9d30224a7dea65b72b7bbb16796483b09034a

Sharing

Copy URL Twitter E-mail

General

Target
echo-Setup-1.2.2.exe
Size 83.6MB
Sample240709-fa2mesyfjh
SHA256 538625f9a7445060633674211aa9d30224a7dea65b72b7bbb16796483b09034a
MD5 ae244f20bb1f0ef9b59ca3a8f68f9ee9
SHA1 46fa43ea3b307bc68e771e582fbd409f56a8de4d
SHA512 367d429c0b048a9ffc97c38135609d3b119182e7c6a4b08399fd490e9b2f2b2585e68d560a1f2b28359e0c8c36bcc762b04dd98f9f5946277c0d4c17bb9d50e8
SSDEEP 1572864:G6gUDBSOQJXbL5OPQVQQZMJsIuW3IELNAe0uT7OeDF3jOZ1:G6LDBSO4XBOPsQQuP/3Guz9S1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  echo-Setup-1.2.2.exe
- Size 83.6MB
- SHA256 538625f9a7445060633674211aa9d30224a7dea65b72b7bbb16796483b09034a
- MD5 ae244f20bb1f0ef9b59ca3a8f68f9ee9
- SHA1 46fa43ea3b307bc68e771e582fbd409f56a8de4d
- SHA512 367d429c0b048a9ffc97c38135609d3b119182e7c6a4b08399fd490e9b2f2b2585e68d560a1f2b28359e0c8c36bcc762b04dd98f9f5946277c0d4c17bb9d50e8
- SSDEEP 1572864:G6gUDBSOQJXbL5OPQVQQZMJsIuW3IELNAe0uT7OeDF3jOZ1:G6LDBSO4XBOPsQQuP/3Guz9S1
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 83.1MB
- SHA256 ff5758a6fb05f2d92b5f89ea42856e9c89520cba44be4024582cea72fd36ae65
- MD5 a576c2eb25b57ac159026e5c2c8dbc53
- SHA1 a41b15182f78de6bdbbc1d9cfd389278cb3a3321
- SHA512 29b9715f47bef13080f7e4db61cdd6f7aed1933375cca276b1bcb9243fe50a0bf7002ed49554df91716c4020df01cd4bbc290e195ded13629c54b21428198265
- SSDEEP 1572864:DgUDBSOQJXbL5OPQVQQZMJsIuW3IELNAe0uT7OeDF3jOZG:DLDBSO4XBOPsQQuP/3Guz9SG
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  LICENSES.chromium.html
- Size 5.2MB
- SHA256 bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
- MD5 4247afa6679602da138e41886bcf27da
- SHA1 3bb8c83dc9d5592119675e67595b294211ddbf6e
- SHA512 ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
- SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  echo.exe
- Size 133.1MB
- SHA256 2312e8fb1738a48e0527464968cbabd8d02dbf69cde9e3cb61dcd47d78ad1381
- MD5 bfadc181245478806f97cfbaf4e06c57
- SHA1 723a150dcbeffed304ed3421a6b35c61d1b009b6
- SHA512 09c1116b78954066fb050f22a46402d91e05b6f7225432e8989863c198ebe01155b4a9432a9665dffbaba82b72ac12016b5587284bc9df3b52403dfbbec54b33
- SSDEEP 786432:xcgzAL4pDrN1IeBzLwgB7jpjCuaZuggecoBxjQHikt3lumUPQbGaCRP:2dL4pfTIeVLwgB/cuafC11Px
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 567fe35b7287c872cc50ee77a7e4cf5763caa33892b7994ab47894f534ff5a47
- MD5 7f1ef8b63fc87f7b476e5aa192672458
- SHA1 40b181c8e6538c13f0cfb5653f93d52031ffa858
- SHA512 b8a164f025da9f76644cb3d57c5bcbf5ddeef78434e492dc5a69b1886e1735384cd747eb66f58e762f2750c1d1f74002a823f8b18cd858ffefb2523fc482dfe9
- SSDEEP 49152:WaOoZks54czfQNk9GSQABmZuZgAp1iJxgG1broIhj4OxSZpSq:pt59uEBm8geZz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  libEGL.dll
- Size 431KB
- SHA256 7c52fc5693e128656d3aff81da51ceed0e035da57d00ccceabafa97b74f27069
- MD5 1d9a67475de599e54bc86a8de8f300f2
- SHA1 e4850b902232e727cddcf96c88be64f8395d5acc
- SHA512 03b397463cef9c1ec01f5cd89c80eedca77a12e32eb46bad073cf3477843d14163b3de62a2dd299cfba5c7b1e368cf83f0759ee8d5f7b823902f32172d5712c7
- SSDEEP 6144:npKolEK3EyQVAZvhnzGtMY+3lnLdYcUpwOXW4IUo+lTsRLdDc2/:nBl1EyyAZvJWM936wOJTWdDc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 baf6f58949320f2aed9f2cf1adafcc95dc213c2c22b3eb92f0f02a2b1f0ebfc9
- MD5 5cfc8302ddff464405d4c960d4a1b923
- SHA1 8cc54eaf52c38b4f933da98a970b987bfdb15324
- SHA512 cf3b54fe6e0105c12da0f019442a71c4eb7509c49f0e4c5674d08446d0503304aa6d15f683659adef30e78b9abfceebf811df931bc5911dc6bcabcaa3eb76b3b
- SSDEEP 49152:5Du07+HIKKqyDBW1ua9A+flyhRKB2ACkI+dkLWzuzAB1qcSLqBD+3N96sGKgMQG/:5Tpj+f0O84eLwgXYCbvut1ffKsIm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
- Size 1KB
- SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
- MD5 05d07534c94e2d589bcc02e96e1b9503
- SHA1 3c3712ecff74a1099c4d65e4eefd9cf2e38f1119
- SHA512 7c7526f2b4e685cc7e20689ebe5abf7630b738d2d15ab7b5e94765e0e6f221492e9e029f715f5b3ac156d3d11ffd907e070d2d7f968b5f5fb401aa9c7ec84ea5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
- Size 5KB
- SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
- MD5 63db540f7184a372ac611fc3d7f21136
- SHA1 0b3a8e70600a6705297a532849b7470c34f8c19e
- SHA512 1f56bbc4856fbefd21f6de0738712157b91f1388a71a957c37444b617ee161885822b21fcf4e7efe14d5af54b9706d8181acbb286dbd7525c91a56b53dc391be
- SSDEEP 96:+6TvjlNAJQppvvTa3USVOMXWKtxr0rTARlmDk1d9PATBVXTcYbhwn4Fq:phNAkjSVOMGQ0rT9Dk1daDX1i4Fq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
- Size 1KB
- SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
- MD5 90c1aa9f031e818373c2f2f7ed6b9dbe
- SHA1 b6476cdfa45ab967436ba9bb32aac1d65e531a9f
- SHA512 4ee766da766530bb372d8e04b058edd6b28ca5d77f603b175336e9b5e8f5c677e77e0ea4afc07a642c07c48e0c209716dbd9cef4f6ab97864a9ea51af2b49bbc
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
- Size 815B
- SHA256 d1f1a9af4234aed56139239ad564f913eb2fac8557c563e95dd996be77d515f8
- MD5 8bc573d6a10d8f58933208ca68dcd6b3
- SHA1 d59311732c5d79093724177370d24fa62c5bd2c7
- SHA512 4c16af93cf066168ab14cf8fe557288035d1726ce02be934f8d61cfbb64275d5e805ab7d1153cebc34af95c5d03e3a6a55dd7ee4ef49fbb31606da750225e2bf
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
- Size 6KB
- SHA256 fb70eb71679fbbf78c17126a71dbe9f9a5840c2a9e93e1f5b6a890e8ed0c4921
- MD5 7c914a18d35f49a5d74e946e9b00a097
- SHA1 d607d93eb6170701f52d24460c2385f2aa7a7712
- SHA512 e8b2221c29df7771ec67dee81524fc9e00f10e381976c1f84e511742ef69a4aa2655dc8e9998e5850c61614ac4abe95a8ca9ac9e37e03618606d0d2fc4a66a75
- SSDEEP 192:JbY5uVR4x435efvxSRuSaCqoXN/6NvCAN1x6RIN4wqMdoR:JbY7apefpSRuSDVAvCAjx6kqeI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32