zloader | c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

Sharing

Copy URL

Twitter E-mail

General

Target

SignalSetup.exe
Size

126.3MB
Sample

240918-jcer8azdnl
MD5

d00b33ffec18ea912241a7f687a64d8c
SHA1

2f3d534916f1a5f1e59d6c861d5e41bff065ec13
SHA256

c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8
SHA512

14dd54ad55bd0b7e8c7b9181204587c6ba0b1b9e9cd748ee8669b1120b17ff63647cc124950c536408fb38958d41d2a3d4b4c9fe9e1bba55db6f282d7e9278f6
SSDEEP

3145728:OVbtEpBMufRS4HITiNPO4nsa7jegaqidl:qbtYMujH5N24ntegBidl

Score

10^/10

Malware Config

Targets

- Target
  
  SignalSetup.exe
- Size
  
  126.3MB
- MD5
  
  d00b33ffec18ea912241a7f687a64d8c
- SHA1
  
  2f3d534916f1a5f1e59d6c861d5e41bff065ec13
- SHA256
  
  c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8
- SHA512
  
  14dd54ad55bd0b7e8c7b9181204587c6ba0b1b9e9cd748ee8669b1120b17ff63647cc124950c536408fb38958d41d2a3d4b4c9fe9e1bba55db6f282d7e9278f6
- SSDEEP
  
  3145728:OVbtEpBMufRS4HITiNPO4nsa7jegaqidl:qbtYMujH5N24ntegBidl
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  LICENSES.chromium.html
- Size
  
  9.0MB
- MD5
  
  f017c462d59fd22271a2c5e7f38327f9
- SHA1
  
  7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
- SHA256
  
  40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
- SHA512
  
  72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
- SSDEEP
  
  24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Signal.exe
- Size
  
  177.7MB
- MD5
  
  60395fa951d43300e09d76c7b1b876d1
- SHA1
  
  94f5757c2bba2f918cec19f1832e058c2558e5e7
- SHA256
  
  7261c1766bfbddf94b14e3b266b210df18e1e94500770c849dd7841d1a206d2c
- SHA512
  
  d8811a23f5de57b9b6e61cb03e5fd57e390538df38966e08f5a2839ae8b4d39998888bbabf19276836b28d7a3281ff5046573c62e0b27e399c8cd1ce6bc54f85
- SSDEEP
  
  1572864:v+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnaX:vA5kyGScBQT/
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  1e0098b10c27e88026a57f4ada4d4730
- SHA1
  
  42b091f0d812002ff35a5411d84b9c314d47f3ef
- SHA256
  
  2ee0f50892b73d06b9466f880e26b1e874ac85974e0dd31118cd874dcde9bb42
- SHA512
  
  3ee139a2e20af64b51b38e609cce50c0e88ac4fff2350f48413a4acc8f56d79a369af9b4c2e10f107802357010f736f7c28c791cd2997e0d830de75eae3fb98a
- SSDEEP
  
  49152:ICZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNa:vG2QCwmHjnog/pzHAo/Ayb
Score

1^/10
behavioral14
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  0c637e52377adfae60a11e1656c03606
- SHA1
  
  10f08cc6af71c772a045674fdc3f6c5bed882f7f
- SHA256
  
  5194b6ff6ca8d57129fcd9685e495d1748d3933a3a962e00d53f046c344d1259
- SHA512
  
  e8d6d854486a4fd5c643c65fea2f5518d6ef27f426c77983a31aead0e64f869dd375a7c84326c33a759681e110fffb2a42d60756aa21c561346faeb52af99147
- SSDEEP
  
  49152:bFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6r:bFjE/CxqnyKk+r1/Hr
Score

1^/10
behavioral15
- Target
  
  libEGL.dll
- Size
  
  485KB
- MD5
  
  1a0757e9814eeeaf9d6e3802d206ab94
- SHA1
  
  394fdd80b8a4bf1b2263c67775b891024df673dc
- SHA256
  
  8a0bcb2e1e5a9db53923a4b4a28e9d3556e143f602af5fe91354e5a06ce949e3
- SHA512
  
  c4d032a9b9157aab8887abed1f434dfc8a0689a8f5a17e5340004f2df87f8422a033924eba97436ef7ad7298934e85a97f14417784b47b78e57b38c0d1c9aae4
- SSDEEP
  
  6144:kTQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu99N:dIDq58JFGrIKLDWNW2+u7fS41f7N
Score

1^/10
behavioral16
- Target
  
  libGLESv2.dll
- Size
  
  8.0MB
- MD5
  
  d1ff2ac8dfe49b8846208ec710c28426
- SHA1
  
  d2f1d2c0805ba91c4b0963087745d0da9f85bca8
- SHA256
  
  3a70592d4b77abe4005040d70647fa7db0851def813f59430418be011d1c5f3a
- SHA512
  
  1e1ecd36db0a0c5dc589e29831c432773b5c001d4b9b4b3bd28ae1c0f5222b2433b5ac6099965b476fc0748531b2badbd555e3d2d9e26438b3e880eac6b1396f
- SSDEEP
  
  98304:oAb24VjbjUkC/f5031ZIXytRt1lK6XC3aB:oAb24VjbIk2sEol/maB
Score

1^/10
behavioral17
- Target
  
  resources/app.asar.unpacked/node_modules/@indutny/simple-windows-notifications/build/Release/simple-windows-notifications.node
- Size
  
  191KB
- MD5
  
  5b0aed1a4ea1055682c09e5cc97e92a0
- SHA1
  
  e8040ca28bee0acb18dab7865d9778a7b596343a
- SHA256
  
  c192835cf15d1cc41cea39678b9fab2e633343d559b0a705115bf35192890f43
- SHA512
  
  dbedb15b9c22d6f6d51360fb5cf5583f9a07849ac0e87e6bb2847a270c324bd9296b6499c1db94a9dfe5a9ca74e5c57931c8a6f402da18fc3436c953111aa501
- SSDEEP
  
  3072:yQ8+SWF2u365XvW+AuGpZIoJk/uJfc5zBPyvbomm/ThK+r:lS2cvW20I3uJ6avA/g+r
Score

1^/10
behavioral18 behavioral19
- Target
  
  resources/app.asar.unpacked/node_modules/@signalapp/better-sqlite3/build/Release/better_sqlite3.node
- Size
  
  4.7MB
- MD5
  
  ca94cda7e4116a2f8a19d58b04325972
- SHA1
  
  f624a90d91f54821d702ba500229b2c2f937a1b9
- SHA256
  
  570b02dbcd2976dcdf21c07269551f60837d590541a8ed6e1442d917b67fe887
- SHA512
  
  153d77e42675abf14b3a73401e87a41e559b2e2fab1c33194e525e1d8be33f471283def51470143bdfb496f857c7397310ebbb5a370ac82e34b11a107731010d
- SSDEEP
  
  98304:G9+WpwYWzBhWr2ShZQnBFVwLW14lOAQpWcSCH:avCXWr2SX6BFVwLyUO3H
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar.unpacked/node_modules/@signalapp/libsignal-client/prebuilds/win32-x64/@signalapp+libsignal-client.node
- Size
  
  14.0MB
- MD5
  
  dabdf1031ed47e231b19e88e6c1b5f84
- SHA1
  
  c6940f7ba64e968a32fea4a96bcdb5219689f834
- SHA256
  
  4c2943c8b7a120b4576c554ba3bd0b5fc6baaca30408b6f5167a9955c59e5168
- SHA512
  
  921913acb90aa1820b041fbba6dbc60df6f46122d4e71a44ae37aa805c0270a0bed9823a3a606169a9af24e18c5cd66049c4a94d4872b6d0ed0c266cbc1f3b37
- SSDEEP
  
  98304:GDGd1j/Eyh0gNfE/Xy72zXp533nAc0XTSTC7tUIaKa4CLhmdU+m0ZWi/ZRmVSK4G:515pBUIaKwhmdU67aUK4XW
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/win32/libringrtc-x64.node
- Size
  
  11.5MB
- MD5
  
  149dc213cf36222b0b437b45a6f2967e
- SHA1
  
  9644ea5476e79718f3e99235a3c71c01eee981c4
- SHA256
  
  fdb8c084ac5bc02a16ec15998acbb2bd98ab34802d870658f2604e95b25a573f
- SHA512
  
  d5668205fcc2ee3d89e31a69ce486d60edebaf29095f6042b6037256dd18c8f8f3f66df8c17b16159e0a12099b9199a34b7571cbcef35b40a1d8b559b2418238
- SSDEEP
  
  196608:pZd1SJZpuv3KrRCmOLALaDCbe9ji/m+5uH9qfTVpuFG:pZdM7puPKrRCmOLALaDCbe9ji/m+sH9W
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/elevate.exe
- Size
  
  117KB
- MD5
  
  691263b6b2e1ae67805cff0ee6c798da
- SHA1
  
  8f560d7bd945dec40fdd4e971795bfe97e505995
- SHA256
  
  75d197dc68e409f45c6b5820256a8073089f558a3745a3eda4f961ffa0994d08
- SHA512
  
  7bcea0ae2cbd36a6da447e544e9f3244fcf6509bb011d26d700e3d31cda0a149e0f226ae7b653561e9d87fe8e44cbc34ca176f9f529f656195a18928bae52f9e
- SSDEEP
  
  3072:wtbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlqKqgn:QPrwRhte1XsE1lzFn
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  5.2MB
- MD5
  
  bc61f9ce1ec9900d1afddc8d1937e267
- SHA1
  
  3d5db748c46a4d4b23bf7b2172a82e86f51e2264
- SHA256
  
  49b749416441f09a6e01d95aba7ea11b3291fb295d19692fc8d4940814cd1eaa
- SHA512
  
  cf30ed57dfdfddbed90b5105ef9a47fa03b551bd1f1f182dde97e485e6b53a39ead4bd983d665091dc18685a83b33790de15c4f8905c3e5e8ddcfb635d401edc
- SSDEEP
  
  49152:kCGM4oeoplNc2pKVnr3AvCCLOySISecKTBMqIxDu99Frv/TJgcs10ZxkWidfOvkc:M7oeop/7ZjrXtxsZBVK2c
Score

1^/10
behavioral28
- Target
  
  vulkan-1.dll
- Size
  
  886KB
- MD5
  
  0483a12dca5f2bce7d5ebe78841fdedf
- SHA1
  
  7137cfafe75c3750ef0cee7467a32ea08e8d7326
- SHA256
  
  ac4f4abf36cb935bd84728b2efa4f027053b13a4707da1639049290366399cf9
- SHA512
  
  ed4a777dde64b5f07870805184a0b58db313eb0adf7c39f439649a030f083fc90fc319f9379ce347b17bbee53263bef100b36f8917364646ac90b8f71b56a803
- SSDEEP
  
  24576:avBtBPI5xicAl7igP7O6Z5W1DYsHq6g3P0zAk7/BoxMKqzN0:aZQ3Adn7O6Z5W1DYsHq6g3P0zAk7+b
Score

1^/10
behavioral29
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Checks computer location settings

Enumerates processes with tasklist

Adds Run key to start application

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32