zloader | 0b3e31beafc65268e9b53eba341e7938b57288ce6a35fea4ffbfaf644a7a0e39

Resubmissions

15-09-2024 14:51

240915-r74zlaydmb 10

Sharing

Copy URL

Twitter E-mail

General

Target

YouTube-Music-3.5.2.exe
Size

230.1MB
Sample

240915-r74zlaydmb
MD5

234e5f9f5a7561c84d671e38bbf3b326
SHA1

d5a831850143bdd0f128f13520923a7ed0b3fa61
SHA256

0b3e31beafc65268e9b53eba341e7938b57288ce6a35fea4ffbfaf644a7a0e39
SHA512

9a530519318722a957cc54eb8aa8d4e8a5c5157fb504d6a22ce55367bf1076c8153268d8aa8d6a6083fd7188246f9b09182d0b0b3043d7257b6195f3ed6d5ae9
SSDEEP

6291456:jev581xUGGqe2+g5ulnmpev59KwzusN9tev5wEFOOdBKtYg:je0h+llmpe+jO9te+wjKT

Score

10^/10

Malware Config

Targets

- Target
  
  YouTube-Music-3.5.2.exe
- Size
  
  230.1MB
- MD5
  
  234e5f9f5a7561c84d671e38bbf3b326
- SHA1
  
  d5a831850143bdd0f128f13520923a7ed0b3fa61
- SHA256
  
  0b3e31beafc65268e9b53eba341e7938b57288ce6a35fea4ffbfaf644a7a0e39
- SHA512
  
  9a530519318722a957cc54eb8aa8d4e8a5c5157fb504d6a22ce55367bf1076c8153268d8aa8d6a6083fd7188246f9b09182d0b0b3043d7257b6195f3ed6d5ae9
- SSDEEP
  
  6291456:jev581xUGGqe2+g5ulnmpev59KwzusN9tev5wEFOOdBKtYg:je0h+llmpe+jO9te+wjKT
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  YouTube Music.exe
- Size
  
  151.9MB
- MD5
  
  c2ff002c1217d8b7ca891fda6298b434
- SHA1
  
  3f46b5c28a4a32f10c82b734647d6862b8347dd8
- SHA256
  
  de9703a4d98434222066f8661a2b637a0fe38bbc1113c23d3c0db6acf4a43d50
- SHA512
  
  0bce8d98e47c291ecc77c694e2a84b9e18fe678150820193d68130b29eb86743b83e54934469b7c64df1cc66c79c8a4d38ddf615b4b44b4786f6721b1ba693b2
- SSDEEP
  
  3145728:esa5i0HhudCq7y0x/69R4eKfk0eNcSKbEoGiC8G:ty+6R4eKfk0eNcSKbEow8
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  3.9MB
- MD5
  
  08ac37f455e0640c0250936090fe91b6
- SHA1
  
  7a91992d739448bc89e9f37a6b7efeb736efc43d
- SHA256
  
  2438b520ac961e38c5852779103734be373ee2b6d1e5a7a5d49248b52acc7c4d
- SHA512
  
  35a118f62b21160b0e7a92c7b9305da708c5cbd3491a724da330e3fc147dde2ca494387866c4e835f8e729b89ee0903fd1b479fcc75b9e516df8b86a2f1364c8
- SSDEEP
  
  49152:pS7/Q+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ij:p4/hqqFVUsLQl6FqVCLTzHxJI9k
Score

3^/10

discovery
behavioral10
- Target
  
  ffmpeg.dll
- Size
  
  2.5MB
- MD5
  
  ddaab0b6f3c40d5b53673c35472bd125
- SHA1
  
  c43d0784fda745b3b8b3bb411edd7825aa3a9f7e
- SHA256
  
  782cb73142fc1ab6fa21aab80fbc337c64872cda8e8a81ba9857ae15e0ebeb87
- SHA512
  
  ccf67e78778c3acf3ee5876d01635b3eaf48375670f2693950d7bd5d62a101adede156b82c1cd155ccc1e040523ebc58556f8f0aedb7e5194632dc78d1c26609
- SSDEEP
  
  49152:FK2JkK5HPzGq1EQi/bVd/vPpV+Tg0EPNyQb2Sus:FK2JkK5HPKqqQi/bVd/vCTg0sNyVSf
Score

3^/10

discovery
behavioral11
- Target
  
  resources/app.asar
- Size
  
  31.8MB
- MD5
  
  654cfb1b08e39106671005731002605c
- SHA1
  
  758e191848a1b87e622264468940946d7c725c5b
- SHA256
  
  e89b356942cfba09a966a32f10824d84759efb5bd6288bef2f76f34b28859ed3
- SHA512
  
  cd22ebc78866e8dc8c20caf236250babbc9da8bf82b27466b01dda36a9c6caa1bf9ebf0f0d8fcdd69d9cc2a3c8caf5d638f9c6d271bd53137c4b952a4ad67b01
- SSDEEP
  
  196608:p5fvu+iO3OnZ9DUQInG44a+G4zHSW7Fed1sWdRnApPX/:p5fv9iO3e9Db7AdRnAp//
Score

3^/10

execution
behavioral12 behavioral13
- Target
  
  resources/app.asar.unpacked/assets/error.html
- Size
  
  1KB
- MD5
  
  516758f2fbabae4faf5d0a65302299c6
- SHA1
  
  c941f4397432840402c07bf1116b6b9363e9bd5b
- SHA256
  
  586b57a0fb53c6da76d1f24f12ed480c883c614f3396fa7b93a746e31411c633
- SHA512
  
  27c0c778117f388fc521b40e58d96f668bd019fedaf8557c395e8bafbc09407a5045afd8588d3fab3bf02513385508f2914152ee7f19e35aa7a8e1b95d351d82
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  
  vk_swiftshader.dll
- Size
  
  4.6MB
- MD5
  
  449d65f8060e69accee7fca67997419e
- SHA1
  
  c0dfe5afb3153c4002fbc736bc53d714c3fe71a0
- SHA256
  
  240870f7bd675d1fee5c3f2c678ea99eedfadfb314cec87a796e6eafdac29417
- SHA512
  
  c0648e0a9f544b485bafc5fc9bc6a2d71833a3d1781d6b5a8715d84ce77da7cddd428cdc38dcaa8023986f78b221d2f5645fad4b51c9b2d9498b6797fc12342c
- SSDEEP
  
  98304:1pdqaOtgvfn/48Bz4Pw6ynXWG7dRu/gZkrOv+QO/aoxqZZ5Jdu:1ijPwV7KOUOW1/aod
Score

3^/10

discovery
behavioral18
- Target
  
  vulkan-1.dll
- Size
  
  760KB
- MD5
  
  c48f50e936f17683bef64f7e2eea79d1
- SHA1
  
  f84de3d32f8850431f9da7f0426c1fd7f6e1498f
- SHA256
  
  05fde012314ea6c3437e162de8cbb7a4ef3c707938b0143c5231c130750fb6c4
- SHA512
  
  a6bcd73e0253a622f7899e821de9cc388b0b6e5ae48d140a1e77a541cd37639e893ee631353a03782cae916b9d65358ef272b4aa60e9f717e048884c9ca9a7f4
- SSDEEP
  
  12288:EEEBH2v8UEjbDzH7yXSPD+o17DdKZwJA96Z5W1DYsHq6g3P0zAk7IuSy:EEEB+8UE3/H7yXUCo17D0w+96Z5W1DY4
Score

3^/10

discovery
behavioral19
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  
  YouTube Music.exe
- Size
  
  177.6MB
- MD5
  
  cfac417a4a8c9140a00ec10b7ed53a18
- SHA1
  
  5bfe859733cd3dfe69094cbfaf6e584f28190c41
- SHA256
  
  01a1212f291aa5148170bb0152f5baae85c170a8b67a5a1c7f35ef9635c279c8
- SHA512
  
  3a0c517240ed7ec0acf83f8c5dacda023e13965d230eb9708b26a494bad7200a5b91c41c68c377d3a5af0775b72b96d1b9fa9c2895b7d092c912a338032a0337
- SSDEEP
  
  1572864:p+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:pA5kyGScXQT
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral22
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  a7b7470c347f84365ffe1b2072b4f95c
- SHA1
  
  57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA256
  
  af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- SHA512
  
  83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP
  
  49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score

1^/10
behavioral23
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  ed10fd2777a030b2895d2f555207f1b3
- SHA1
  
  81448e7a72e49eff746abbedea503139b7eadbdd
- SHA256
  
  996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c
- SHA512
  
  435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9
- SSDEEP
  
  49152:nFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6:nFjE/CxqnyKk+r1/H
Score

1^/10
behavioral24
- Target
  
  libEGL.dll
- Size
  
  473KB
- MD5
  
  e3f6c7b1316f7ca06ee178377ce16ff7
- SHA1
  
  f546da89ec0d3ef238892be8f2dd697d411518bb
- SHA256
  
  ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9
- SHA512
  
  cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b
- SSDEEP
  
  6144:7TQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu9:4IDq58JFGrIKLDWNW2+u7fS41f
Score

1^/10
behavioral25
- Target
  
  libGLESv2.dll
- Size
  
  8.0MB
- MD5
  
  ac216b22cb7ca21d9803ae6b111792e5
- SHA1
  
  f6678626aa522628110315889ca744572549bb73
- SHA256
  
  3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50
- SHA512
  
  df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90
- SSDEEP
  
  98304:dAb24VjbjUkC/f5031ZIXytRt1lK6XC3a:dAb24VjbIk2sEol/ma
Score

1^/10
behavioral26
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  vk_swiftshader.dll
- Size
  
  5.2MB
- MD5
  
  ed0ffde1854aa8b1dc64835b48833d32
- SHA1
  
  5aa09092b982e8ae1ca73f713d6f51a30248b64a
- SHA256
  
  1a24356be288e742549a20c62de9259b2e1cf8bd560151ff7a24d4ae1a4652a2
- SHA512
  
  59fd3b9153b2d777a707c7f2aedf2b7be701c18fb1b9e79d32381dacca22768c6461c575271aee960d7c41fadeba75f8cde41fc8a229c2e49823bbb5853b69a1
- SSDEEP
  
  49152:nCGM4oeoplNc2pKVnr3AvCCLOySISecKTBMqIxDu99Frv/TJgcs10ZxkWidfOvky:t7oeop/7ZjrXtxsZBVK2
Score

1^/10
behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  874KB
- MD5
  
  8f939b8bbffc7e1083e938adc4b5aea7
- SHA1
  
  ce03fd0ec3c11fbbc51b6fef044bea7915991aa9
- SHA256
  
  7d411fa0a615d0f67099fc3978b3f07e28565b9877cce02ec239eb228fa4d485
- SHA512
  
  bed9ac52e82dcf3e8233d90f1f0986ce6371338299a7efc490d89955d869e2b16874cd2258b4217971269f19fb1589530fe2d870d65610a878f2633f0cf4e0af
- SSDEEP
  
  24576:0vBtBPI5xicAl7igP7O6Z5W1DYsHq6g3P0zAk7/BoxMKqz:0ZQ3Adn7O6Z5W1DYsHq6g3P0zAk7+
Score

1^/10
behavioral30
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Network Share Discovery

Checks computer location settings

Network Share Discovery

Checks computer location settings

Network Share Discovery

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32