General

  • Target

    Feather Launcher Setup 1.6.1.exe

  • Size

    104.6MB

  • Sample

    240930-ch61bsscnn

  • MD5

    3a201dabfdaff24a8c208b11049e276d

  • SHA1

    c19478d565e5d3e41347aa65e8cb4b66b31a05f8

  • SHA256

    56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

  • SHA512

    88a769b8587e8f4ca00546ebd21a976349a2532dde0bca6418f07e56d0a6e2b26c451a379b1ff0b5ffc5448e0d0f5e1c72e7821b3ea5cb0f4e07cf8497112472

  • SSDEEP

    3145728:mkQEzg2K6FiBz+GBTRJmgm0Iiy+FO7Ahhq60XYJMP2ZW:mw26YzlggmtB7Ahh9mxeW

Malware Config

Targets

    • Target

      Feather Launcher Setup 1.6.1.exe

    • Size

      104.6MB

    • MD5

      3a201dabfdaff24a8c208b11049e276d

    • SHA1

      c19478d565e5d3e41347aa65e8cb4b66b31a05f8

    • SHA256

      56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

    • SHA512

      88a769b8587e8f4ca00546ebd21a976349a2532dde0bca6418f07e56d0a6e2b26c451a379b1ff0b5ffc5448e0d0f5e1c72e7821b3ea5cb0f4e07cf8497112472

    • SSDEEP

      3145728:mkQEzg2K6FiBz+GBTRJmgm0Iiy+FO7Ahhq60XYJMP2ZW:mw26YzlggmtB7Ahh9mxeW

    • Adds Run key to start application

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      $PLUGINSDIR/VC_redist.x64.exe

    • Size

      24.1MB

    • MD5

      0c86174ca06d892881301203cdf2c32d

    • SHA1

      2b7462bb7732725f011a085349d6d206eed40048

    • SHA256

      5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144

    • SHA512

      16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62

    • SSDEEP

      786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK

    Score
    7/10
    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    • Target

      Feather Launcher.exe

    • Size

      145.0MB

    • MD5

      9ef1ecce599882119c5a0715f66dcc55

    • SHA1

      f6e57a26c0f353ae14302a0a08eed0b4d8946619

    • SHA256

      4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0

    • SHA512

      f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c

    • SSDEEP

      3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p

    Score
    4/10
    • Target

      LICENSES.chromium.html

    • Size

      6.3MB

    • MD5

      997768ae7eb8c036425bed10f766e823

    • SHA1

      2ec99026b977f6603a8a7890bc05594a9a4f13a1

    • SHA256

      ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c

    • SHA512

      f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639

    • SSDEEP

      24576:nP9t5W7WSLzrj41T4mfA6c606q6C6eBcHKcaRpG:gFO

    Score
    3/10
    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      cb9807f6cf55ad799e920b7e0f97df99

    • SHA1

      bb76012ded5acd103adad49436612d073d159b29

    • SHA256

      5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

    • SHA512

      f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

    • SSDEEP

      49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI

    Score
    1/10
    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      68ea02ddbfdd0aa3a694789ee6d95bc2

    • SHA1

      326354fda27d5de1a7bf23b440c6eeb889c7c00d

    • SHA256

      0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99

    • SHA512

      5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e

    • SSDEEP

      49152:qcDHp0Z63RFIEr1OJbJFk1rb1kjKxt0MWH+4WUA8ZQcyTfQV0U5okJO6V8mK9eoP:DDHeimbJKRkQMdZryTfQV0U5okJzKt

    Score
    1/10
    • Target

      libEGL.dll

    • Size

      458KB

    • MD5

      655672c205e37b079c34a4427118479b

    • SHA1

      e1d595a25e76f2f1be50f0ac3046e82462790d69

    • SHA256

      498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36

    • SHA512

      a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92

    • SSDEEP

      12288:aPwG/ja/jvtG2OQ7Aw1qiQhy/Dq1ug3dk:az/QOQ7Aty/Okkdk

    Score
    1/10
    • Target

      libGLESv2.dll

    • Size

      7.1MB

    • MD5

      eb2b911d33f5ba82109a0d5608c28334

    • SHA1

      fbc578fbcfc88a132438b38e97bb87c16a9f698f

    • SHA256

      2404be88c798b43499ab7466e2b04bd58510f0d3fa59049aba6ffb932b65c977

    • SHA512

      19becd2003702813898893f7b1fcd1db179a76fbd201fe34471254b75ba5e98af262922adafe5ef0672302cdf4c0b1e2f8910fd2e51ded0f3c4d6c5a43de489e

    • SSDEEP

      49152:Nk6rcYCLRRdx7IXvR7vjyhUpSOIpgRcbSIXv9RPKSNtc1OAE3tg5qHqwfuXBMwrE:ZYjEXvRhpS7X7T90VSJAxtLNSg1Sd

    Score
    1/10
    • Target

      resources/app.asar.unpacked/native/cleanup.feather

    • Size

      989KB

    • MD5

      7c2dc9165c530f4888ac63233c040560

    • SHA1

      41f5048d8365df3fd35c744ceb49bb5ff0e63edb

    • SHA256

      4fcdb7229bfcaa4b158d0a2b4092e76d8145a1e82fa432c99a7d5ad11eb84e9e

    • SHA512

      a6dcc746353c736d848ae3eed110a519e3db52195f4f02193d322220948073964e53e4d082cf3a07765c48018f357153257cd04d5f5f3d05bb44dfd400b2932b

    • SSDEEP

      12288:R0dD9oALKpJk9ptMn+lYv58SwpJXkvprbCBTmPxVZIVKayDSYd/:R4xJiJkicM8Swp9yrbCBTmP+zOrd/

    Score
    1/10
    • Target

      resources/elevate.exe

    • Size

      125KB

    • MD5

      1d3e78a104f30be7b3f7aa71ffa7900b

    • SHA1

      53463a970842e544c0784abb748d4ac6c17e511f

    • SHA256

      158f83e3dce35ad8943c73d3414fe02a4a9ad73527ec4dbd73c15a94accd2345

    • SHA512

      a35df4ea88a8e44931dcf939958e6004d3024c9d8afa892dcfb8755546505f33fa70b7c04a3d85627ffdef66c08f2fe341a1756a63323fdf6fea17f71f85bdbf

    • SSDEEP

      3072:UVbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYDTDu:kPrwRhte1XsE1lYPi

    Score
    3/10
    • Target

      vk_swiftshader.dll

    • Size

      4.6MB

    • MD5

      17bb7a2a7cd8ccd96ed19753cfc75bec

    • SHA1

      7c996eaa179fd472a572a0efb3e243a81b283977

    • SHA256

      070c9bb970f13a47e3246fbeadd4d2d3916273e1ae3db2059d806691bfeaf6d8

    • SHA512

      80ff7ba1b32e3de374e8637852b96c12882a5f7d32651ff0e1c2cb97898a44aee46a569a42b073a4e368f364f0daae2e86eca36068fe6794eb5ba55cd3ca5ee4

    • SSDEEP

      49152:eg0lNhuGaO/dRxQGQ+mEjWIyKGTJtE+M5q0yN769reA3Em0PNX4WbUEwxWvbG5wW:jm/j7sw7kQtlVdQQog

    Score
    1/10
    • Target

      vulkan-1.dll

    • Size

      849KB

    • MD5

      58871cf606db440509b56a3f764e72e3

    • SHA1

      312e810cfcfb663b0da00eac3b87294c0b035cfa

    • SHA256

      ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea

    • SHA512

      07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4

    • SSDEEP

      12288:EaVRm5GYB4ad1TQxKhZasTkTDimWLr4Tg+v+U8Amor8F:Eaa5GqLd1T6aDk6LrSL2l

    Score
    1/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    • Target

      $PLUGINSDIR/nsProcess.dll

    • Size

      4KB

    • MD5

      f0438a894f3a7e01a4aae8d1b5dd0289

    • SHA1

      b058e3fcfb7b550041da16bf10d8837024c38bf6

    • SHA256

      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    • SHA512

      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    • SSDEEP

      48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj

    Score
    3/10
    • Target

      $PLUGINSDIR/nsis7z.dll

    • Size

      424KB

    • MD5

      80e44ce4895304c6a3a831310fbf8cd0

    • SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

    • SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

    • SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • SSDEEP

      6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck

    Score
    3/10
    • Target

      $PLUGINSDIR/vcredist_x64.exe

    • Size

      6.9MB

    • MD5

      b364dd867258dfc79342e00d57c81bb5

    • SHA1

      c990b86c2f8064c53f1de8c0bffe2d1c463aaa88

    • SHA256

      8588eb697eb2049344e6206d2b66ff63104f1c55e553621ab8ecc504d6b9e9d4

    • SHA512

      d5d5408d7a0bd7731761c601232df77a972592bf027f29771d17fa7b62103b43d98b55516bbf7d45611658a2e477a60ce4cf89a349a85c4abe33186278f4c44f

    • SSDEEP

      196608:xPgzbZpe4yWle1o57XYvWnJZM58q5wAnQwMNf:ez9pIGe1OM59GAQwgf

    Score
    7/10
    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      $R0/Uninstall Feather Launcher.exe

    • Size

      431KB

    • MD5

      aa7f7d9feb8f7dfe57beb5f8897077fd

    • SHA1

      2d9af570e5f934497ad05084c9bea93b5cd35e5e

    • SHA256

      9614a08b840c9ceefa22c5a5dc96393da46890afa6d63aa31ab3ec7d6ce91560

    • SHA512

      832dad9a5ad4c425345b8ce4b7c392ad00a59416e22da3cc69295afaf580db2450ba4af02c40625fbb0dcf732edea0d74e0ae9e35beac7ca87c8a889885a87ee

    • SSDEEP

      3072:mn77v00hEoDEtaul7Zw1mtUjdAaBNlQLJYaH2tvhOEA1RJCir86SrSrvrRbOa3cZ:m740IBZw1QUjdA+QNYs2t0EyL+2iaM/x

    Score
    4/10
    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      ec0504e6b8a11d5aad43b296beeb84b2

    • SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

    • SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

    • SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • SSDEEP

      96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr

    Score
    3/10
    • Target

      $PLUGINSDIR/nsProcess.dll

    • Size

      4KB

    • MD5

      f0438a894f3a7e01a4aae8d1b5dd0289

    • SHA1

      b058e3fcfb7b550041da16bf10d8837024c38bf6

    • SHA256

      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

    • SHA512

      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    • SSDEEP

      48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discoverypersistence
Score
6/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
7/10

behavioral6

discovery
Score
3/10

behavioral7

Score
4/10

behavioral8

discovery
Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

discovery
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
7/10

behavioral21

discovery
Score
4/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.