372b81cb23efd1c29173c72b812793d0e2b60cd4befd8c6917a206830a4c5af3

Sharing

Copy URL

Twitter E-mail

General

Target

Roflection.exe
Size

61.3MB
Sample

240725-r88n6sxfqh
MD5

14d2a481b6b413f276ffcd0bff85bc84
SHA1

9525e71c34b27508d007a74de12d61ea330cf558
SHA256

372b81cb23efd1c29173c72b812793d0e2b60cd4befd8c6917a206830a4c5af3
SHA512

4c38ac673939189c580847005b74b63f5ed902252fb506ddca694a44d8dff2f81b0df1f409079e620caffb736cebe7f6d48dbbb6cb5e87eeffbed3acc25db63c
SSDEEP

1572864:3Vzq5PhfttdirLfjYQ2jcGUMQRe0X9PJFiZ4YWPu:3oBh1jirLfcQzxJRgZ43W

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  Roflection.exe
- Size
  
  61.3MB
- MD5
  
  14d2a481b6b413f276ffcd0bff85bc84
- SHA1
  
  9525e71c34b27508d007a74de12d61ea330cf558
- SHA256
  
  372b81cb23efd1c29173c72b812793d0e2b60cd4befd8c6917a206830a4c5af3
- SHA512
  
  4c38ac673939189c580847005b74b63f5ed902252fb506ddca694a44d8dff2f81b0df1f409079e620caffb736cebe7f6d48dbbb6cb5e87eeffbed3acc25db63c
- SSDEEP
  
  1572864:3Vzq5PhfttdirLfjYQ2jcGUMQRe0X9PJFiZ4YWPu:3oBh1jirLfcQzxJRgZ43W
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  101KB
- MD5
  
  33b4e69e7835e18b9437623367dd1787
- SHA1
  
  53afa03edaf931abdc2d828e5a2c89ad573d926c
- SHA256
  
  72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
- SHA512
  
  ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77
- SSDEEP
  
  1536:Ayy+wx2YAlWrU5OX9crt5c4DBqiC7hk333kbQk:ry+wojIwgNcr1a7WH0b
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  75ed96254fbf894e42058062b4b4f0d1
- SHA1
  
  996503f1383b49021eb3427bc28d13b5bbd11977
- SHA256
  
  a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- SHA512
  
  58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP
  
  192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  5.1MB
- MD5
  
  6b84319ee8a0a0af690273d3d2dcbaf4
- SHA1
  
  857ca353e0582d100dcbc6cb6761bb4430d0cb90
- SHA256
  
  fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
- SHA512
  
  26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
- SSDEEP
  
  24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Roflection.exe
- Size
  
  129.8MB
- MD5
  
  77e73e6ad584def493fda2130eef776e
- SHA1
  
  a41e44b19945cd8473aec091efb6fd2e177e582d
- SHA256
  
  d4a2c6052852ee4106cb895a9dfc6caedf3a889a371ce3478e8ff9272bfe358e
- SHA512
  
  bdecd5fe6dd372284ff62439bfb60f0de161d32ca9430e507466cd6ad9dad1993f50afee3b3e8d7ad886c53f42b20020db7ab652f8f582fd8e5f0fd6f80097db
- SSDEEP
  
  1572864:7mYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:K4M7a2H4Ryu+dNgI
Score

7^/10
- Loads dropped DLL
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  7c3c780de9ae5cc4abeccbd7cb6b367b
- SHA1
  
  bda27b3c0b1ec023e2a0a97099a84b10e04cb135
- SHA256
  
  39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
- SHA512
  
  80a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
- SSDEEP
  
  49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOv:dCZpX+q27saesDSjbv
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  429KB
- MD5
  
  b3017453d487a7d33445c1d2d9b9bc13
- SHA1
  
  7e643ccb8984a4a92dd439eeb4bdaaeb62bd8862
- SHA256
  
  23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
- SHA512
  
  fd583f4b95aa974d72628bcc548feb22bc86c5ab0fd1536995bd796e28422f56e6799d60e2c3bef9aed9a1080eaf12338a3b29b8c3d40ba5166030a219572baf
- SSDEEP
  
  6144:67Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5n+t7dPs:wUdu1NElX7QR2osJ5+XP
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.6MB
- MD5
  
  dd8d815769cbf46af41a41931e9b4572
- SHA1
  
  f242fcc4cfd5030f3f543c22f141185cd86e7142
- SHA256
  
  dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
- SHA512
  
  69a12f862157746ffc27b637941261a0c5c494175c3e674c7de4d0c4452a5b9358735944e8e0568b7279a7791cf178c9b1afd5ea4a781e93f28cd775a0a6096f
- SSDEEP
  
  98304:p5a6GJCIf2Knqdu5iIBIcbWwYSqARSHoDNSv:pKIwBqARSH
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  
  swiftshader/libEGL.dll
- Size
  
  448KB
- MD5
  
  038a73114d439bfc94be4732b2794998
- SHA1
  
  4b7a9d52da1bd808af979cf5cfb146404494317a
- SHA256
  
  b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
- SHA512
  
  8788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
- SSDEEP
  
  6144:/H0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xnLB4Vz:/MCOJ7lFx7zxt6dEY0VLSV
Score

1^/10
behavioral24 behavioral25
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  3.1MB
- MD5
  
  38ec86347b3e467c5868e35ab48f89f2
- SHA1
  
  4db17d065cc330b277a70f9fb8dff0c4b426f314
- SHA256
  
  2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
- SHA512
  
  2b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
- SSDEEP
  
  49152:EAtfKpPXV/5DdijA29+0QdjwSx+qovRYFDguXfol+4iduejy3bEW2ehvxLTL10dO:nwNynDyguydMVW5v1
Score

1^/10
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  4.5MB
- MD5
  
  0d3deb7dc62ea45c6624aab2b1ed8071
- SHA1
  
  0e4a7276784e3d8e6d6440669a65bd88f840b078
- SHA256
  
  cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
- SHA512
  
  38b674e0a0fefe1fa61ae144e6707b0eb7cfb73a8d01315f2b984cd1ebeb017cddeb89e39daa0f5806cc295a540e826a97422a677c361ebab3f8e4767228e5e6
- SSDEEP
  
  49152:53YxjaP0AETYj7g/yaI75j/7wiSmQEZLT/lbMnP3cuJUiId+R9iETUjdCB2KmGsl:UAbIASP1aRldQ
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  707KB
- MD5
  
  3cffcffbf394159458566fb79b9abd3f
- SHA1
  
  7e0f09e9ea67e9e587305e2f740c8620dad12595
- SHA256
  
  26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
- SHA512
  
  93a73aef9237d52119f9886ca6eff7975cdd6931d12087ea4c0397807b19c6195e24045d80b606bfc45f754c58ab5b1f789d95e91250828629724b9446501c55
- SSDEEP
  
  12288:Dwc+2rLfirhAu07HvM5BSNraGMiuvo52Ap:D82r79KBSwBiuv
Score

1^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  3d366250fcf8b755fce575c75f8c79e4
- SHA1
  
  2ebac7df78154738d41aac8e27d7a0e482845c57
- SHA256
  
  8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6
- SHA512
  
  67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094
- SSDEEP
  
  96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32