zloader | 30863f7a149c41c3edb9537a1e93321faab3c68fed49cccbaeddb099388b14ac

Sharing

Copy URL

Twitter E-mail

General

Target

Caprine-Setup-2.60.1.exe
Size

78.6MB
Sample

240908-wpc6dasbmh
MD5

f8989e3199b5e7d44938a3714a229662
SHA1

bc22cc8f7293eecff4a4192057c0cccdba0ccb8e
SHA256

30863f7a149c41c3edb9537a1e93321faab3c68fed49cccbaeddb099388b14ac
SHA512

4b0a7c82e96c68d688f45bef78b12e0f29c0795255096c48971c6fa05804b59e5129016fd2816c0c0f2c417e32583e78c1b712cf010bde7b45875af77c0c093d
SSDEEP

1572864:SIe4hJceZOfh0m5EUwHwwW6k7b99xX1jPEGFiDlolvkNHs8KxQ1wr3:SIe42rjewDhlNFiDmGbcQmr3

Score

10^/10

Malware Config

Targets

- Target
  
  Caprine-Setup-2.60.1.exe
- Size
  
  78.6MB
- MD5
  
  f8989e3199b5e7d44938a3714a229662
- SHA1
  
  bc22cc8f7293eecff4a4192057c0cccdba0ccb8e
- SHA256
  
  30863f7a149c41c3edb9537a1e93321faab3c68fed49cccbaeddb099388b14ac
- SHA512
  
  4b0a7c82e96c68d688f45bef78b12e0f29c0795255096c48971c6fa05804b59e5129016fd2816c0c0f2c417e32583e78c1b712cf010bde7b45875af77c0c093d
- SSDEEP
  
  1572864:SIe4hJceZOfh0m5EUwHwwW6k7b99xX1jPEGFiDlolvkNHs8KxQ1wr3:SIe42rjewDhlNFiDmGbcQmr3
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/UAC.dll
- Size
  
  14KB
- MD5
  
  adb29e6b186daa765dc750128649b63d
- SHA1
  
  160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA256
  
  2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- SHA512
  
  b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP
  
  192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/app-64.7z
- Size
  
  77.9MB
- MD5
  
  a8297e3cb4904474a58fbbb3b2dd9f5a
- SHA1
  
  709eaa4c2c2689cae88a115ee512673cfa42aa43
- SHA256
  
  1cbf74790e61a10240e516a6916951a2f8669542942329cac0fb161d00225f4d
- SHA512
  
  4e0682a05e096140f55dfac552ed62a8ee6f7210117d65bb8bd4a799e52683f4e95396ed1706a562b1aa9188a93f38b082b9a44e6d15392333ad033edbb5310c
- SSDEEP
  
  1572864:Be4hJceZOfh0m5EUwHwwW6k7b99xX1jPEGFiDlolvkNHs8KxQ1wrB:Be42rjewDhlNFiDmGbcQmrB
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Caprine.exe
- Size
  
  168.2MB
- MD5
  
  d8cb17b77335bdcad6d90f31524a96e5
- SHA1
  
  3dd47209e96fea6ef18d6ae18ca0e58c3819e410
- SHA256
  
  77a9a1d1160671f19be29f2965bf50ad987d9e6c660f5231665ee31aef4ada02
- SHA512
  
  30aaf3791ea08f55705c867505c1e46d1267a18d8000c45063416f409e3d56ca5e3cc1583ce6efd1bedddabdf4cd1fd37d9e861d540bab533028bc894bb6d3f1
- SSDEEP
  
  1572864:hIPWtb+TnTrz8AWSnsWNUWRTMgnHogf5pmehttXQCYENi3OW8ScBy9fzg29H:KWesC9RBydzb
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral13 behavioral14
- Target
  
  LICENSES.chromium.html
- Size
  
  8.7MB
- MD5
  
  bd0ced1bc275f592b03bafac4b301a93
- SHA1
  
  68776b7d9139588c71fbc51fe15243c9835acb67
- SHA256
  
  ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- SHA512
  
  5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP
  
  24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral17
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  52853f4b936e6cea6950f1520e2206aa
- SHA1
  
  76a2c4080c819d65738707421fca45926bd5c471
- SHA256
  
  3711bfe359daadc4c40042b7ee309d3cf8a084e50edb19ac51be46e601178849
- SHA512
  
  fd43315be0b9614eb19b9dba6f86809088cf42c474459c5fc332a0ec2ff60403072ad5dff7c7d30b5af50092af1eb70e7569712b813f0608adcd01536528f1a4
- SSDEEP
  
  49152:0gUBJTIe17EwJvr3OXtgTyFBcCen6yfUvUUP/bkLyV:DY1vreXOuFePUP/bau
Score

1^/10
behavioral18 behavioral19
- Target
  
  libEGL.dll
- Size
  
  467KB
- MD5
  
  72c40c4c6cafe9f2c13d03d1b3dc5330
- SHA1
  
  72d51ead2fc7cdd9d42f4f5298207a74591708c8
- SHA256
  
  4d4a5fa2c7cc5f9cea69b3098ac9d5b1dddb26a9fa8740cc33201f30d1405e56
- SHA512
  
  004c7e109102ab96317358b929aea4b916f561b7387efeab1c25dfe8f832fe9223d4b7dd2c9c24ec37165b3e0bd81f8f734b38142f78cbb086147d909f86235f
- SSDEEP
  
  6144:vaEXc0Izd+rYvqNUMbh9L8OgKcG4BEFATaxlI/:VdIZ+rwqNUMbFL2BE6W8/
Score

1^/10
behavioral20 behavioral21
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  b69d1fe22c9921824f404af5947b66f5
- SHA1
  
  ce998ee9fd8116e31773620deb8056c55c507ab8
- SHA256
  
  14a03f20123021134dfc366455c59349a2fe082ffef81aeb54826a226248c43f
- SHA512
  
  1461e71f6fe22d31cfe328d96d53d1aad2ec2139156c90a9121bcb0f70faf3ed0a85143749b71ba8ec9a9f0355cc9960f25a117110bd62a14a45536f67f04484
- SSDEEP
  
  98304:u99bSJY8juRSvODN1uVZ5U7NJhbXm3fo:ueu8iEOx73hzCfo
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/@sindresorhus/do-not-disturb/do-not-disturb
- Size
  
  9.6MB
- MD5
  
  b1f31829a0e96ae8f3ef11072a53a45f
- SHA1
  
  b019befdd9968cd061d80fbefecc281e126afc7c
- SHA256
  
  bc21adb6d2f95b7a1970aec4d6a872abba490d6a743d2dc665e3b7fa3c9784f4
- SHA512
  
  844fca90a373569f8a1be77ad89cc76a2c3a49f9280172992e86ac2e2130c38520de2f9c973c47ed76bd562582bbf1de9b87f96d5de3e83ad761a52898f5b515
- SSDEEP
  
  196608:1zfFNQjRQyoOkmHEL+MzPLJyd3bKH9LVA:dFqjRQnG3bw9LVA
Score

4^/10

evasion
behavioral24
- Target
  
  resources/app.asar.unpacked/node_modules/@sindresorhus/do-not-disturb/index.js
- Size
  
  1KB
- MD5
  
  543442a82a00e25526d660cb30fb976e
- SHA1
  
  bb3d41bf36f52e041e1f85f95ffdc71fccc62ffe
- SHA256
  
  57d3ef38cd8cdabc64b4d3e48a20df043c56953283e62f01103a98f21350393c
- SHA512
  
  fce5d2507eb13681c8675eb4b6b5adb1828ca0b1a28bbca3c9a1a376d017380b5969877fce9ae8ab80571806624e505fa60e65cbcf8ca904711a32b9601673a9
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  vk_swiftshader.dll
- Size
  
  5.1MB
- MD5
  
  d45cc85b4e5763a553f3cffc9f161beb
- SHA1
  
  99b06d080a4ecc3a8419eab025181918c43ac87e
- SHA256
  
  c9c85b52674ba40d768f752cb3011f41ae676310ae49d4e91f8d877ba747e3db
- SHA512
  
  ef4d53c2f6d22569a149cdfcfee00eabd4333a4ca7a88fed32f990225f4e5c5a1c8379d74f4d75a5f715a4c24244b2868fc74e021e0cfcfa11bf53d28d0746d5
- SSDEEP
  
  49152:UVZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:aZ+aDJkD01VKOOO
Score

1^/10
behavioral29 behavioral30
- Target
  
  vulkan-1.dll
- Size
  
  932KB
- MD5
  
  2cd830cd809dcf87d92b2f06ceaeafad
- SHA1
  
  220b562cd67566fae6c90b20246475e5c9653f47
- SHA256
  
  18e8770322af77f66b64dfbf096638d9e8f13edec0801e53a8506a682cf93dcd
- SHA512
  
  cea50c9e8c4686f1dd3a653483727e43dd6a56d939f3b85c033d8e50741f93132fdd0757d7d14ec1cd8cac9cfe8bd1c3de2d3ee671dcba01c02487d0c78783ae
- SSDEEP
  
  24576:SB3udp6Q9s8rpPaolZhGd6Z5WiDYsH56g3P0zAk7l18DC:SaDlrpPaoZGd6Z5WiDYsH56g3P0zAk7l
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

Checks computer location settings

Unexpected DNS network traffic destination

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32