Overview
overview
8Static
static
3fextify_1....up.exe
windows7-x64
8fextify_1....up.exe
windows10-2004-x64
7$PLUGINSDI...ID.dll
windows7-x64
3$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3fextify.exe
windows7-x64
1fextify.exe
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3General
-
Target
fextify_1.1.5_x64-setup.exe
-
Size
3.1MB
-
Sample
241002-ypvfrstfjj
-
MD5
557dff39355db5d3faa85b2953d17aff
-
SHA1
241e1466cc2dac4c87170b3df610fff6279a9f21
-
SHA256
a9aebe0c85244e0bb616646dd9abf0e459dbbaf9e2b8b11cf1fd900c61630f9f
-
SHA512
128cb53c767654d0a8c39ae241f5c6dab99674f8c112612c33f53bbb865a0dcaea0f9b299338d99f628b35cf67c34abb2c7166e42108cb8a315cc97b9c927b52
-
SSDEEP
98304:h9J5gL5ex27CMW4AV+g+JHQTI0E6V3NO4c4Q:hkUhx+10Tu4Q
Static task
static1
Behavioral task
behavioral1
Sample
fextify_1.1.5_x64-setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fextify_1.1.5_x64-setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
fextify.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
fextify.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
fextify_1.1.5_x64-setup.exe
-
Size
3.1MB
-
MD5
557dff39355db5d3faa85b2953d17aff
-
SHA1
241e1466cc2dac4c87170b3df610fff6279a9f21
-
SHA256
a9aebe0c85244e0bb616646dd9abf0e459dbbaf9e2b8b11cf1fd900c61630f9f
-
SHA512
128cb53c767654d0a8c39ae241f5c6dab99674f8c112612c33f53bbb865a0dcaea0f9b299338d99f628b35cf67c34abb2c7166e42108cb8a315cc97b9c927b52
-
SSDEEP
98304:h9J5gL5ex27CMW4AV+g+JHQTI0E6V3NO4c4Q:hkUhx+10Tu4Q
Score8/10-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
-
-
Target
$PLUGINSDIR/ApplicationID.dll
-
Size
198KB
-
MD5
91c2e2f34b5bba068e9a6178e13a4e5c
-
SHA1
affcac00894c9afd152e55d0bff7899349edcd6c
-
SHA256
f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
-
SHA512
ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
-
SSDEEP
3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
Score3/10 -
-
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
d070f3275df715bf3708beff2c6c307d
-
SHA1
93d3725801e07303e9727c4369e19fd139e69023
-
SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
-
SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
-
SSDEEP
96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
6c3f8c94d0727894d706940a8a980543
-
SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd
-
SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
-
SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
-
SSDEEP
96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
Score3/10 -
-
-
Target
$PLUGINSDIR/nsis_tauri_utils.dll
-
Size
1.1MB
-
MD5
1e38f56aba852b737f2866c48b823165
-
SHA1
53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
-
SHA256
0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
-
SHA512
5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
-
SSDEEP
24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
Score3/10 -
-
-
Target
fextify.exe
-
Size
6.3MB
-
MD5
0779e0541e8839b2a013bb769b548955
-
SHA1
ada66a02cdfe9e040c23e29b053f03161038a351
-
SHA256
515aa666d310869bf0fa8ebc96fa46e221be298d3f3d4baca19dfe43682bb3d5
-
SHA512
ab7dbbffe3e861699d2f98e04ba01e49a9273b252bf44d5c1926906c70393bd911419ae753329f982183b9b26d059a85b32ecac9905d786a2bafec35288ce1b9
-
SSDEEP
98304:MY9sekrJP5KVuqETSIZxUdJatWnVE0HBpJTm:MssXJBW6xycothf
Score1/10 -
-
-
Target
uninstall.exe
-
Size
669KB
-
MD5
e01042bd48ed3e358219766200b64c31
-
SHA1
3f8f6f15a9e015d0e7083dd79448b1b0e1f081b3
-
SHA256
b364e9fd94a0480cd1f2747ec72e1c1f2be0223e4ddf6b9d39a9fe9c3d4d1447
-
SHA512
38f44069235842b2661d5af538f75b28183b1c030dc133d31b00393c959e71a5d499e7914720f9f46ea9310d8c78b052d55d40e92a839e787c977555a782b073
-
SSDEEP
12288:AYQVkXPy4dyom/A36EMVAslywaiXNUjTol4grANQRfxeK4lcvEGqTQ3Sr1:AYQVk5yO6dfnSsrAaBEnTQ3O1
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
68b287f4067ba013e34a1339afdb1ea8
-
SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3
-
SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
-
SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
-
SSDEEP
48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
cff85c549d536f651d4fb8387f1976f2
-
SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
-
SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
-
SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
SSDEEP
192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score3/10 -
-
-
Target
$PLUGINSDIR/nsis_tauri_utils.dll
-
Size
1.1MB
-
MD5
1e38f56aba852b737f2866c48b823165
-
SHA1
53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
-
SHA256
0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
-
SHA512
5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
-
SSDEEP
24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
Score3/10 -
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1