Overview

overview

10

Static

static

10

GenesisLoa....0.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

GenesisLoader.exe

windows11-21h2-x64

4

LICENSES.c...m.html

windows11-21h2-x64

3

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/app.js

windows11-21h2-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...er.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GenesisLoader Setup 1.0.0.exe

  • Size

    76.9MB

  • Sample

    240925-12yeaszgqn

  • MD5

    e1c1b8a1d76e93fc226a6f756d722fc2

  • SHA1

    cbf54abec6f29bbdb17dfaa06c8442a0a1feaa03

  • SHA256

    28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a

  • SHA512

    b7cc02efa2434ddcd1578e161422a330c4375a542cc99b9843dff0e5daee51c61ba9f182e8dddcc40de65521f7b0582bb9d4c3c994676a40b7298428f4a20d3a

  • SSDEEP

    1572864:4M/xlZ1DRhZ04pONinTIXK7hqs+RfibhiB7XLVjvaTI:4yTzO4nsaYIb0B7XL/

Score
10/10
zloaderdiscoveryexecution

Malware Config

Targets

    • Target

      GenesisLoader Setup 1.0.0.exe

    • Size

      76.9MB

    • MD5

      e1c1b8a1d76e93fc226a6f756d722fc2

    • SHA1

      cbf54abec6f29bbdb17dfaa06c8442a0a1feaa03

    • SHA256

      28834f3eb57c18ad25c9b65a3fb5b242207a1b92e06c6d721a6c16f7009c326a

    • SHA512

      b7cc02efa2434ddcd1578e161422a330c4375a542cc99b9843dff0e5daee51c61ba9f182e8dddcc40de65521f7b0582bb9d4c3c994676a40b7298428f4a20d3a

    • SSDEEP

      1572864:4M/xlZ1DRhZ04pONinTIXK7hqs+RfibhiB7XLVjvaTI:4yTzO4nsaYIb0B7XL/

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    discovery
    behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    discovery
    behavioral3

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral4

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    discovery
    behavioral5

    • Target

      GenesisLoader.exe

    • Size

      177.5MB

    • MD5

      0bf04247bbef6d43600ae79d51ee0dd9

    • SHA1

      4716c7fdcdd18aeffe12b7febb75fdb75ae573b3

    • SHA256

      0f15adf631964c14dcf9afdcd28086e584ce002ffd7705ceff934ad18e9bec95

    • SHA512

      6aed1c9fb0d8ca1a9b876b5887def2318bd9565a35caf31c80ef4228fc5b8d226c9ff3fb649241031483195bd8be7d84b5cc90a89e142095ff95cfd40d7931a2

    • SSDEEP

      1572864:z+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:zA5kyGScXQT

    Score
    4/10
    behavioral6

    • Target

      LICENSES.chromium.html

    • Size

      9.0MB

    • MD5

      f017c462d59fd22271a2c5e7f38327f9

    • SHA1

      7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9

    • SHA256

      40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37

    • SHA512

      72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07

    • SSDEEP

      24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

    Score
    3/10
    discovery
    behavioral7

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      a7b7470c347f84365ffe1b2072b4f95c

    • SHA1

      57a96f6fb326ba65b7f7016242132b3f9464c7a3

    • SHA256

      af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

    • SHA512

      83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

    • SSDEEP

      49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc

    Score
    1/10
    behavioral8

    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      ed10fd2777a030b2895d2f555207f1b3

    • SHA1

      81448e7a72e49eff746abbedea503139b7eadbdd

    • SHA256

      996aed5bb751d70e215bcc3e5be2ed28fb54412af05031c592df101b51232e0c

    • SHA512

      435f33fd11fc25a495726401211ed87771c831eab8916b8bb9520bf0f799646f911b22716f090849bfc85e2372cd28aa1c9de46f9d613929993ef009955173e9

    • SSDEEP

      49152:nFjQnjfFEokq/eG+xqIiyxU6b+rq+X6CfUBXY/JBY6:nFjE/CxqnyKk+r1/H

    Score
    1/10
    behavioral9

    • Target

      libEGL.dll

    • Size

      473KB

    • MD5

      e3f6c7b1316f7ca06ee178377ce16ff7

    • SHA1

      f546da89ec0d3ef238892be8f2dd697d411518bb

    • SHA256

      ff6d4f18492a704b4b9d853abdcc73a4fa561b0c685619508e25afaf4e4800b9

    • SHA512

      cad4026efc48192c4904a4b0ec583d2e24b94f8a5f91824716eddb32477512799b10a4f9cc7a2976a25ca0d333bb1c68bb98b1d0f9bd7020e0e31be7d950720b

    • SSDEEP

      6144:7TQILNFetxbb8J6AGrIKLD0Rf8KRWAwi+u7fS41stlu9:4IDq58JFGrIKLDWNW2+u7fS41f

    Score
    1/10
    behavioral10

    • Target

      libGLESv2.dll

    • Size

      8.0MB

    • MD5

      ac216b22cb7ca21d9803ae6b111792e5

    • SHA1

      f6678626aa522628110315889ca744572549bb73

    • SHA256

      3cd10952ba73ba4a36f5ec92dcbb0893092bfc8d77a381f6f9f3090b0ecfbb50

    • SHA512

      df344f79ff5d4e38b451bea948c234b63af0402565097082a082b44a4efb9e0ed367884875cbc817237b7ae7ac126fc7de0e8615504923b8db553c1a3a985a90

    • SSDEEP

      98304:dAb24VjbjUkC/f5031ZIXytRt1lK6XC3a:dAb24VjbIk2sEol/ma

    Score
    1/10
    behavioral11

    • Target

      resources/app.asar

    • Size

      476KB

    • MD5

      8df09ddb5b31a8fa0af894f7d42d7422

    • SHA1

      5042c6fdc26392e867cd379c8d2d571d6ba7a4eb

    • SHA256

      56918c11f3c552bdeb664e574e210d80a17838105f669d1769c80f90556f8a08

    • SHA512

      749a13c28b9d7f3675e3e78f45b374d6c1a85df8b851461b9669c1e355842dbf7cf4f2e3f9040f0f04e0537e57efefa00802ac913eef4c912ca184e79e081150

    • SSDEEP

      12288:7eAqTpFiHnyDXK8wuwIVKgVReqwjAE9sf1gLQoD:7qVK6p+F9uPoD

    Score
    3/10
    execution
    behavioral12

    • Target

      resources/elevate.exe

    • Size

      105KB

    • MD5

      792b92c8ad13c46f27c7ced0810694df

    • SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

    • SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    • SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • SSDEEP

      3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

    Score
    3/10
    discovery
    behavioral13

    • Target

      vk_swiftshader.dll

    • Size

      5.2MB

    • MD5

      ed0ffde1854aa8b1dc64835b48833d32

    • SHA1

      5aa09092b982e8ae1ca73f713d6f51a30248b64a

    • SHA256

      1a24356be288e742549a20c62de9259b2e1cf8bd560151ff7a24d4ae1a4652a2

    • SHA512

      59fd3b9153b2d777a707c7f2aedf2b7be701c18fb1b9e79d32381dacca22768c6461c575271aee960d7c41fadeba75f8cde41fc8a229c2e49823bbb5853b69a1

    • SSDEEP

      49152:nCGM4oeoplNc2pKVnr3AvCCLOySISecKTBMqIxDu99Frv/TJgcs10ZxkWidfOvky:t7oeop/7ZjrXtxsZBVK2

    Score
    1/10
    behavioral14

    • Target

      vulkan-1.dll

    • Size

      874KB

    • MD5

      8f939b8bbffc7e1083e938adc4b5aea7

    • SHA1

      ce03fd0ec3c11fbbc51b6fef044bea7915991aa9

    • SHA256

      7d411fa0a615d0f67099fc3978b3f07e28565b9877cce02ec239eb228fa4d485

    • SHA512

      bed9ac52e82dcf3e8233d90f1f0986ce6371338299a7efc490d89955d869e2b16874cd2258b4217971269f19fb1589530fe2d870d65610a878f2633f0cf4e0af

    • SSDEEP

      24576:0vBtBPI5xicAl7igP7O6Z5W1DYsHq6g3P0zAk7/BoxMKqz:0ZQ3Adn7O6Z5W1DYsHq6g3P0zAk7+

    Score
    1/10
    behavioral15

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    discovery
    behavioral16

    • Target

      $PLUGINSDIR/nsis7z.dll

    • Size

      424KB

    • MD5

      80e44ce4895304c6a3a831310fbf8cd0

    • SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

    • SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    • SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • SSDEEP

      6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

    Score
    3/10
    discovery
    behavioral17

    • Target

      $R0/Uninstall GenesisLoader.exe

    • Size

      348KB

    • MD5

      4fff7b059155e4ef42acbb96bf031c01

    • SHA1

      168b219d7e716374af7f71d9f6b31ccd7a5f7613

    • SHA256

      667f3631149bf909af520f1b6250b991d2e9e3cc7e08072027a75f37fc655fff

    • SHA512

      a711c63d9061cfb04e89b1b38cb92425026afeab0594b779e4c43ad7fa5f5e574f402d9ec2f9185f6711d9fc406f9c7925ca99295526f21ea4dd9612e90a4280

    • SSDEEP

      6144:g740IrgY8QxBBmlZ6O/0JEcAEffWKqsgEOiKUZPwngm3q+5A/Ecn/9s2t0EyL+yj:6IgLQotAE9sftqwwyV4i/Ecn+RKJU

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral18

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    discovery
    behavioral19

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    discovery
    behavioral20

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    discovery
    behavioral21

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    discovery
    behavioral22

MITRE ATT&CK Enterprise v15

Tasks