General

  • Target
    FantasyLauncher.rar
  • Size 90.9MB
  • Sample240810-sdtr7svapp
  • SHA256 5f4b9ae4506d950030be7c04bbc0cc038b63b862401c34d5130ddaddd66976bf
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Targets

    • Target
      FantasyLauncher.rar
    • Size 90.9MB
    • SHA256 5f4b9ae4506d950030be7c04bbc0cc038b63b862401c34d5130ddaddd66976bf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      FantasyLauncher.exe
    • Size 91.0MB
    • SHA256 ce22a4a12abf7caad89fa8dbe07e0f1b997f481b726fc90d88910752ad1d1048
    • MD5 SHA1 SHA512 SSDEEP
    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    • Enumerates processes with tasklist

    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      $PLUGINSDIR/app-64.7z
    • Size 90.3MB
    • SHA256 2531ac417c451e4cb3dea3abbfca3c47e97daea9b73cfc3c8c2081a773fefff7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      LICENSE.electron.txt
    • Size 1KB
    • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
    • MD5 SHA1 SHA512
    Score
    1/10
    • Target
      LICENSES.chromium.html
    • Size 8.4MB
    • SHA256 ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    • Target
      MysticLauncher.exe
    • Size 158.4MB
    • SHA256 033a5c42dfaaaaae1b2121d36f22391833f5f7334267aba97594382110b0a542
    • MD5 SHA1 SHA512 SSDEEP
    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    • Enumerates processes with tasklist

    • Target
      chrome_100_percent.pak
    • Size 132KB
    • SHA256 24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      chrome_200_percent.pak
    • Size 191KB
    • SHA256 55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      ffmpeg.dll
    • Size 2.7MB
    • SHA256 742c956f892ad0833a5b8c52d19aa69940bc15bedbb42890598df61b263f6fed
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      icudtl.dat
    • Size 10.1MB
    • SHA256 7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      libEGL.dll
    • Size 469KB
    • SHA256 d9773c57e821ef87891375d687c68c0be75222316a666e8c49640aad80f60959
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      libGLESv2.dll
    • Size 7.1MB
    • SHA256 49ace76d838e02994a03354e557ae65a305d9c5c8441774fa174177451e26dc9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      v8_context_snapshot.bin
    • Size 581KB
    • SHA256 ed559c6e81b6003b2057e5c1b0bdb5b28ca094b895ca86c69fe11c5c9e014f06
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      vk_swiftshader.dll
    • Size 4.9MB
    • SHA256 58e2b5ab33366550207ed8e1f420b24c94b19fbe8e753f5a6c038beb829533a7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      vk_swiftshader_icd.json
    • Size 106B
    • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      vulkan-1.dll
    • Size 917KB
    • SHA256 7fb87a7f0d50007dca64bf845d444fc66116a57edecdd8487c91d6879b578a0f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      $R0/Uninstall MysticLauncher.exe
    • Size 244KB
    • SHA256 dd4f8e1f11451b82081f8ef510d54814fbb17e1056002f9064f7cbee0791adb9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks