147274d9afc26a3fdfa72ef3449a22300b63705bdea75a879676c9ac2d07435d

Sharing

Copy URL Twitter E-mail

General

Target
Wave-Setup.exe
Size 125.7MB
Sample241104-plbptaypcv
SHA256 147274d9afc26a3fdfa72ef3449a22300b63705bdea75a879676c9ac2d07435d
MD5 983cb04d46c8f8f0d54bcb49d4482920
SHA1 38bb61429d7c75fccf688fb60ecbcd5b0e7a76ad
SHA512 e3b5a03a800daa726c20ed9ff994aa5f88d4ee443e8784358bd5eb73f421ff6759f8dd879b08ecce4a428153f006bdfef76c6330174f8e9e149b0476964734e2
SSDEEP 3145728:reJknx1xzhnEUouCsSyAPgdg3ib33ohJH69WfKNZLZM+tpB5zRY:8kx1xFPoXsSyANib33ovaNZLZ5m
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Wave-Setup.exe
- Size 125.7MB
- SHA256 147274d9afc26a3fdfa72ef3449a22300b63705bdea75a879676c9ac2d07435d
- MD5 983cb04d46c8f8f0d54bcb49d4482920
- SHA1 38bb61429d7c75fccf688fb60ecbcd5b0e7a76ad
- SHA512 e3b5a03a800daa726c20ed9ff994aa5f88d4ee443e8784358bd5eb73f421ff6759f8dd879b08ecce4a428153f006bdfef76c6330174f8e9e149b0476964734e2
- SSDEEP 3145728:reJknx1xzhnEUouCsSyAPgdg3ib33ohJH69WfKNZLZM+tpB5zRY:8kx1xFPoXsSyANib33ovaNZLZ5m
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Wave.exe
- Size 172.5MB
- SHA256 1562c3548c59d0e37854c91bfa38e518b75359820969774e4915a6f3ba8ac7d0
- MD5 bbf068e87fc9dfae8fbd668d7d283041
- SHA1 a38bd4e9c9a94478ae315b593da237586779222b
- SHA512 4772d876e74b01ee79047b167a24287bce50247559071758359dc202b25203990be0f7a754a8b6ccf8dce70441088e7b62ef29c9f3a4f8a0b449afc5b4afb2f6
- SSDEEP 1572864:uV00dKoWtUBaArjpGI2O6QMsjI1RaZjVdiX5H5z8GTzXts3XYpfLW5q:/grm7i5
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks for any installed AV software in registry
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 223448ec1715cb4b1a2abbf1427547956f3ce583092177c287542e6d226319c7
- MD5 9691e33909895bfb5bb0355b6f439c81
- SHA1 7fca2dfcb9aca4ed92c644e8f7ceb98f87116a52
- SHA512 9ead46836900c054d8740a1e2f569bc321cc53cf3c47e3fa927f4cca54809bcf173bdea239fbdeecd694277e8869565e476fd272df393b924bb62a845e897533
- SSDEEP 49152:01nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYC:0Jsf83Sn6Ox+tP5C
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 470KB
- SHA256 1307025ed98ecfd00770c2d5c74c8a5e498c4e457397f17c3cbd176ca8a62a85
- MD5 09d3bc8a5c6104d78566cd6e51c5a6a8
- SHA1 d1db4f83bad27dc0caf75f77d510f2eb62dd84c4
- SHA512 198072fff54bd6ae5ac21bd891c23da9d657a4525dd5944719eda6f7062775ae66d9cb15d29105d2477378ae605351e4b840c9934106bf80f936a596e7a1eddd
- SSDEEP 6144:xmi12qlTgeUDsnkcM2nDl83BgENhYCqNNfY24M:xmk2qxgeUDsNnDcgENhYRNNfU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 8e68245d98bb740f393472938612979a56391f127d1af7683253e9e749e7af41
- MD5 02374701c3dc3b26088763fd3cc11bc9
- SHA1 84e582496c53ce139d9efd219b762ad38a50d011
- SHA512 09693492447b037e8ce16095fb3d63d806604d18c3340bf57fecc0e0ae3c877bdcd83320e633b0fb898a4c20616bfb4558ccd8d93a10d235dd90c3be8020a8a2
- SSDEEP 98304:uPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:uP4m8TDyluKGugmO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/@next/swc-win32-x64-msvc/next-swc.win32-x64-msvc.node
- Size 129.6MB
- SHA256 4e95a6b7173bf7b8855ab5c9be5191e7ac1220815ff591648a105302b7c916fe
- MD5 f75a6b3605cd7f11c5c5932174841fc8
- SHA1 26386f4fd16ae147d321dbafb297908ff615668a
- SHA512 a50842668c35783463bd3f5247558cdd9de84f8903202d4f53e1db53c2206785b4657f08b42325f46f78376b4a9520447de39d68fe5462d14f4ab0d8ac273f4d
- SSDEEP 786432:oALXbV8vgY9hcfPEeOEf+SzpHesbJSqj/NP:9VGIPEGflX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
- Size 436B
- SHA256 9bb0e59dfd1cc00fc40bed0ccf10d88414d915d79875b9dee5c1d5009f4e89cf
- MD5 30894042a167528293c057f833e7b6f2
- SHA1 ec993fedf1f1a22c77b985c72d8b0074811ea680
- SHA512 2b544b29e44e0471a9da5474209bc15cb81a44a38448a74a7a67f4ed3ca7d1926cef4b2b13d3269fb785a468d00f1cfc042d2a7d6b4d563725da65028e2df15f
- MD5 SHA1 SHA512
Score

4^/10

discovery execution antivm
behavioral20 behavioral21 behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
- Size 78KB
- SHA256 d35c0d3af8f66984b1ead5cb56744049c1d71ef0791383250ad1086c0e21f865
- MD5 de5ecb14c8a2212beb309284b5a62aae
- SHA1 cf89d1cbd52f3183590b33bd6be591f95a6f5291
- SHA512 fea8a49538f5fd4cb8c262c1619f9f8e906edeef7d3c791bd3b85f032a0499aa5f18b4370a00e1f4dab9698e1958b042cab467103598f1bdaa583eb1fb918c07
- SSDEEP 768:AzE0/Tw0orfubmn3b7mX69Ne4xfX6irumhSA3eVqT3l8:43ZBm3b7mX6aO6Ds
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
- Size 1KB
- SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
- MD5 05d07534c94e2d589bcc02e96e1b9503
- SHA1 3c3712ecff74a1099c4d65e4eefd9cf2e38f1119
- SHA512 7c7526f2b4e685cc7e20689ebe5abf7630b738d2d15ab7b5e94765e0e6f221492e9e029f715f5b3ac156d3d11ffd907e070d2d7f968b5f5fb401aa9c7ec84ea5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
- Size 5KB
- SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
- MD5 63db540f7184a372ac611fc3d7f21136
- SHA1 0b3a8e70600a6705297a532849b7470c34f8c19e
- SHA512 1f56bbc4856fbefd21f6de0738712157b91f1388a71a957c37444b617ee161885822b21fcf4e7efe14d5af54b9706d8181acbb286dbd7525c91a56b53dc391be
- SSDEEP 96:+6TvjlNAJQppvvTa3USVOMXWKtxr0rTARlmDk1d9PATBVXTcYbhwn4Fq:phNAkjSVOMGQ0rT9Dk1daDX1i4Fq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
- Size 1KB
- SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
- MD5 90c1aa9f031e818373c2f2f7ed6b9dbe
- SHA1 b6476cdfa45ab967436ba9bb32aac1d65e531a9f
- SHA512 4ee766da766530bb372d8e04b058edd6b28ca5d77f603b175336e9b5e8f5c677e77e0ea4afc07a642c07c48e0c209716dbd9cef4f6ab97864a9ea51af2b49bbc
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
- Size 979B
- SHA256 2b577f3fd8e3d03d64c1ee07ef13db89df04d0a9cf7b69ebf2c17041f7251104
- MD5 2e6f9c975170db8136c9ca5c5ecf2a0c
- SHA1 404a2c64977cae3407aa138c23a2f841546f713d
- SHA512 15bfa9fad522ddc043383704cac725c8cc2b4565708b891e9e03d889237cd528ee4d347e54a983c801550856c2d1ac1269dcc127edfa6d63bf3d2aa0a19eb358
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks for any installed AV software in registry

Checks installed software on the system

Enumerates processes with tasklist

Checks computer location settings

Executes dropped EXE

Checks for any installed AV software in registry

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32