c1ce85233af641b7c1cf831a3d95639bf439caa72386d01ad77797e0317e1d2d

Resubmissions

24/08/2024, 21:20

240824-z61jsazfne 7

24/08/2024, 21:16

240824-z4evaszeje 7

Sharing

Copy URL Twitter E-mail

General

Target

Pterodactyl-Desktop.exe
Size

56.1MB
Sample

240824-z61jsazfne
MD5

a1daa3cda2c7f5af0a1886e4e8f8f55d
SHA1

af1a5a793a24d032123897b8460a96368ef1f09b
SHA256

c1ce85233af641b7c1cf831a3d95639bf439caa72386d01ad77797e0317e1d2d
SHA512

1029b065709107602c97f857dc1c202c15f071621ba61742d5020acb9fce3b6b33e53057a8b616ab920caee49a2cb649cc190777976e4432b7043442132ed2be
SSDEEP

1572864:PxF1s9gfxr8oeidjJHqL+ruicJJQY+iPEt:PxF1s+r8eJruicE5WEt

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  
  Pterodactyl-Desktop.exe
- Size
  
  56.1MB
- MD5
  
  a1daa3cda2c7f5af0a1886e4e8f8f55d
- SHA1
  
  af1a5a793a24d032123897b8460a96368ef1f09b
- SHA256
  
  c1ce85233af641b7c1cf831a3d95639bf439caa72386d01ad77797e0317e1d2d
- SHA512
  
  1029b065709107602c97f857dc1c202c15f071621ba61742d5020acb9fce3b6b33e53057a8b616ab920caee49a2cb649cc190777976e4432b7043442132ed2be
- SSDEEP
  
  1572864:PxF1s9gfxr8oeidjJHqL+ruicJJQY+iPEt:PxF1s+r8eJruicE5WEt
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  14KB
- MD5
  
  adb29e6b186daa765dc750128649b63d
- SHA1
  
  160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA256
  
  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- SHA512
  
  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP
  
  192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  5.1MB
- MD5
  
  6b84319ee8a0a0af690273d3d2dcbaf4
- SHA1
  
  857ca353e0582d100dcbc6cb6761bb4430d0cb90
- SHA256
  
  fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
- SHA512
  
  26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
- SSDEEP
  
  24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Pterodactyl Desktop.exe
- Size
  
  129.8MB
- MD5
  
  8d31a6ec3edf1f6bc88df0506368d63d
- SHA1
  
  b9b924b1291e822723fffc98cb05d0710b7641cd
- SHA256
  
  6c451ed78396efe6e4e1b0d997b82a7db2d3de81d6a26b51b43ec37f4088862c
- SHA512
  
  5e3b2597fb0093b0de4e3d64c7024310c2b5a05ebaa7b07fbe9f7a6283decb978183c6554c4f8352c19e967f416e4f4feb23ecd630098de7ee9a655f498cbf0c
- SSDEEP
  
  1572864:omYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:f4M7a2H4Ryu+dNgI
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  7c3c780de9ae5cc4abeccbd7cb6b367b
- SHA1
  
  bda27b3c0b1ec023e2a0a97099a84b10e04cb135
- SHA256
  
  39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
- SHA512
  
  80a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
- SSDEEP
  
  49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOv:dCZpX+q27saesDSjbv
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  429KB
- MD5
  
  b3017453d487a7d33445c1d2d9b9bc13
- SHA1
  
  7e643ccb8984a4a92dd439eeb4bdaaeb62bd8862
- SHA256
  
  23046e7fe2bbf76ee2c5596b6beac723ad465fdbaa44266486102cdb292148a1
- SHA512
  
  fd583f4b95aa974d72628bcc548feb22bc86c5ab0fd1536995bd796e28422f56e6799d60e2c3bef9aed9a1080eaf12338a3b29b8c3d40ba5166030a219572baf
- SSDEEP
  
  6144:67Udu1o3YnElXvzYhRk9o+3Re3wpcOQy5n+t7dPs:wUdu1NElX7QR2osJ5+XP
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.6MB
- MD5
  
  dd8d815769cbf46af41a41931e9b4572
- SHA1
  
  f242fcc4cfd5030f3f543c22f141185cd86e7142
- SHA256
  
  dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
- SHA512
  
  69a12f862157746ffc27b637941261a0c5c494175c3e674c7de4d0c4452a5b9358735944e8e0568b7279a7791cf178c9b1afd5ea4a781e93f28cd775a0a6096f
- SSDEEP
  
  98304:p5a6GJCIf2Knqdu5iIBIcbWwYSqARSHoDNSv:pKIwBqARSH
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar
- Size
  
  7KB
- MD5
  
  db22d5cd2999c82be704eebd0d66bb29
- SHA1
  
  a4cc638e02f7d35e80e86d4d0f106f24199dd23b
- SHA256
  
  c898741db40a5e6502bbc98684bab35e40501241e33af125807c82c5dcae1092
- SHA512
  
  28206e32d68386b8eccedd0e6ac2f1804e694a0a2adf7704578b16760c8500532db4de7dd19ce972017e28109af8043105b3015deb00e6d66f534a9f009087c6
- SSDEEP
  
  192:hHR+MNG10Hoy1vh1b8eBTSTB6bihoVgGn:hhomyyTSTB6buyb
Score

3^/10

execution
behavioral22 behavioral23
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  
  swiftshader/libEGL.dll
- Size
  
  448KB
- MD5
  
  038a73114d439bfc94be4732b2794998
- SHA1
  
  4b7a9d52da1bd808af979cf5cfb146404494317a
- SHA256
  
  b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
- SHA512
  
  8788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
- SSDEEP
  
  6144:/H0B/LCOJ7lTp0k7zKd0POc37Tta9pdEp2si0xnLB4Vz:/MCOJ7lFx7zxt6dEY0VLSV
Score

1^/10
behavioral26 behavioral27
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  3.1MB
- MD5
  
  38ec86347b3e467c5868e35ab48f89f2
- SHA1
  
  4db17d065cc330b277a70f9fb8dff0c4b426f314
- SHA256
  
  2e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
- SHA512
  
  2b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
- SSDEEP
  
  49152:EAtfKpPXV/5DdijA29+0QdjwSx+qovRYFDguXfol+4iduejy3bEW2ehvxLTL10dO:nwNynDyguydMVW5v1
Score

1^/10
behavioral28 behavioral29
- Target
  
  vk_swiftshader.dll
- Size
  
  4.5MB
- MD5
  
  0d3deb7dc62ea45c6624aab2b1ed8071
- SHA1
  
  0e4a7276784e3d8e6d6440669a65bd88f840b078
- SHA256
  
  cc947f08b87f4636213211b22328c32d1986d49abc96a619799091fa6a15c851
- SHA512
  
  38b674e0a0fefe1fa61ae144e6707b0eb7cfb73a8d01315f2b984cd1ebeb017cddeb89e39daa0f5806cc295a540e826a97422a677c361ebab3f8e4767228e5e6
- SSDEEP
  
  49152:53YxjaP0AETYj7g/yaI75j/7wiSmQEZLT/lbMnP3cuJUiId+R9iETUjdCB2KmGsl:UAbIASP1aRldQ
Score

1^/10
behavioral30 behavioral31
- Target
  
  vulkan-1.dll
- Size
  
  707KB
- MD5
  
  3cffcffbf394159458566fb79b9abd3f
- SHA1
  
  7e0f09e9ea67e9e587305e2f740c8620dad12595
- SHA256
  
  26460b9250e904a9db6e5e0893e746a84ffae21c02e083e3f33a913d7cc79111
- SHA512
  
  93a73aef9237d52119f9886ca6eff7975cdd6931d12087ea4c0397807b19c6195e24045d80b606bfc45f754c58ab5b1f789d95e91250828629724b9446501c55
- SSDEEP
  
  12288:Dwc+2rLfirhAu07HvM5BSNraGMiuvo52Ap:D82r79KBSwBiuv
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32