General

  • Target

    XrayInject1.2.exe

  • Size

    81.0MB

  • Sample

    241113-y6ermssjdp

  • MD5

    d8f10b83e6923f5d41c6b44156ad5dde

  • SHA1

    2ce44d3146d62be6e9d8c671c717d1d2e4c85310

  • SHA256

    599eb6a50a0c7b170a6d7736433cb408c7f935448efffc6171ced9ec5d25f690

  • SHA512

    fa2eed9886bc9a2f8984752793deb5eb981db76238a139909060ffced0b5ed2e92e6cf9d592d223f1a02f676f6299f6716409cd09504220aa65787abcd0a3e28

  • SSDEEP

    1572864:iSnyk/h70iyDDdzIYQLSocpaefLTPn6l/JrRzXkTQykT6udmBXqc7:ieybDD1t/zrLTPn6l/JlmkWudmFqc7

Score
7/10

Malware Config

Targets

    • Target

      XrayInject1.2.exe

    • Size

      81.0MB

    • MD5

      d8f10b83e6923f5d41c6b44156ad5dde

    • SHA1

      2ce44d3146d62be6e9d8c671c717d1d2e4c85310

    • SHA256

      599eb6a50a0c7b170a6d7736433cb408c7f935448efffc6171ced9ec5d25f690

    • SHA512

      fa2eed9886bc9a2f8984752793deb5eb981db76238a139909060ffced0b5ed2e92e6cf9d592d223f1a02f676f6299f6716409cd09504220aa65787abcd0a3e28

    • SSDEEP

      1572864:iSnyk/h70iyDDdzIYQLSocpaefLTPn6l/JrRzXkTQykT6udmBXqc7:ieybDD1t/zrLTPn6l/JlmkWudmFqc7

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      LICENSES.chromium.html

    • Size

      9.0MB

    • MD5

      f90bec233251fd8b0cec0a2aa45be071

    • SHA1

      9af25a284eb14f1a8d5e67fd91d7f963d7a9c3d6

    • SHA256

      1479be3660c7ebfa60813d7ce9c5f017d25946ef762b3f1cc571180b25151e48

    • SHA512

      23dec29517ff7ab9999462211844d369f5f7e582037914d1be98af3bf43c41417a27c32314507d19d37d87d9acc4c8da085948794cfe32689dba7a2e0a393b04

    • SSDEEP

      24576:G8QQf6Ox6j1newR6Xe1Vmf66k6T6W6r656+eGj7dOp+:fGoeGd

    Score
    3/10
    • Target

      LNpSUHD317.exe

    • Size

      177.6MB

    • MD5

      5b7459d6d91a51dabfe9d021ff8bbf4a

    • SHA1

      49ab5e90730130ab9eb201ee8430a069dd8948d9

    • SHA256

      290229164fc6b0bc5bb69e77e672c8e0120740d39fefa5f69eea6d1163c3de0f

    • SHA512

      d9a134502d079a72c4a5eb9615ad77e10285887b3d28147c38e8077bc851b26989f36076837a3d5c0a24d3c2381083aa84ede2fd19068f9145c3f566c211e4a7

    • SSDEEP

      1572864:fNvGCNRixbPlrp4MpeU4cpVblbtHvJb7ZlBS3bQiOFx++/305WNejZlqE6N0okBN:fmbJBrh5c

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates processes with tasklist

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      a7b7470c347f84365ffe1b2072b4f95c

    • SHA1

      57a96f6fb326ba65b7f7016242132b3f9464c7a3

    • SHA256

      af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

    • SHA512

      83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

    • SSDEEP

      49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc

    Score
    1/10
    • Target

      ffmpeg.dll

    • Size

      2.8MB

    • MD5

      60bc255d5ddd8fc9c8be4c82108a2c8b

    • SHA1

      ad1a0606f27d95608e02d6ad0c40b342008d8f24

    • SHA256

      cd0ccc24489532a6c6e977ea4d25250d9850a395b51c46f90b47ed21ef8044ba

    • SHA512

      fc50c39cdcf60a622cd4b63490c9ef2b4e3897acc05b25e900bff5d351431628e8141048995deb28de270b002d67a3976a4b528a5b50b5d1cac6683f48f1fb38

    • SSDEEP

      49152:bshioTdyDPLVt7Spx275ydSNTGuNt+X6Cf2B+J6/VTTfV:bseVtsx29ywBGuB/T

    Score
    1/10
    • Target

      libEGL.dll

    • Size

      473KB

    • MD5

      998ccce35f45d91eda0fbf2272923b03

    • SHA1

      9c99a7a8e4dec171cc0499e229730a241c164fbf

    • SHA256

      ad75ac7d0fe26ee9665c075e705d290233732feb897173597a18887b3d1cad7b

    • SHA512

      b5cf010ccfe4083d83e5c3c8df144bbf30eef991ac2f91f081562cf7e2b4182447cc4f86508fbd1ec229a6a34ab1907c861276776d8f657f557cea2ff7b3003e

    • SSDEEP

      6144:KL1WWZ6zNA2dOUq3lfxGtcLDMx28ARKNrdZHXOb/sk4siui:uWQwZWlwtcLDm+KN7HXOb/sk40

    Score
    1/10
    • Target

      libGLESv2.dll

    • Size

      8.0MB

    • MD5

      06d7890e8f5423bf90a02137af53d95b

    • SHA1

      980f746f895bef998bb78d7adaccddfab6a9aa5b

    • SHA256

      586a04652de1a392e8f0c4cc69ece9b7370be4953b9fa4019d09207578324e42

    • SHA512

      bad64ac5761e2db7a9453b731c10ba13409aa8793c7e82d56c48c6231f923debb960f89d92eb69ca2914283b85d4102e8e1ec38cb7bf3d1009fc390b45ccd605

    • SSDEEP

      98304:s6VTc3DGigGJ7rDYaLjrBccGmTlc5eWXLXC3PIvd:s6VTc3DGLo7B7DGmJWTmQvd

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js

    • Size

      412B

    • MD5

      0b33e83d33b01a51625a0fdcbef42ce3

    • SHA1

      1c29d999ff7da39426b97f2eb31a3d83db8f5fc7

    • SHA256

      a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2

    • SHA512

      1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c

    Score
    3/10
    • Target

      resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node

    • Size

      137KB

    • MD5

      04bfbfec8db966420fe4c7b85ebb506a

    • SHA1

      939bb742a354a92e1dcd3661a62d69e48030a335

    • SHA256

      da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

    • SHA512

      4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

    • SSDEEP

      3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node

    • Size

      1.8MB

    • MD5

      66a65322c9d362a23cf3d3f7735d5430

    • SHA1

      ed59f3e4b0b16b759b866ef7293d26a1512b952e

    • SHA256

      f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

    • SHA512

      0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

    • SSDEEP

      49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js

    • Size

      224B

    • MD5

      f0a82a6a6043bf87899114337c67df6c

    • SHA1

      a906c146eb0a359742ff85c1d96a095bd0dd95fd

    • SHA256

      5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74

    • SHA512

      d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240

    Score
    3/10
    • Target

      sqlite-autoconf-3440200/Replace.cs

    • Size

      7KB

    • MD5

      335ee30449b5d0d52ab314dbff93d52f

    • SHA1

      02c67258801c2fb5f63231e0ac0f220b4b36ba91

    • SHA256

      74ba0687a84c328df2836f73d7d36368099a5f5c1c360a84211e51fa71f1dfc0

    • SHA512

      02f40bc955c833105811f78471e29f062c1cebfe4bd96ffba941670c0026ad5bbc81f336b7c2c6b9f804c67ed46c9dabab927ec0fb4c709bd7a049454f27073a

    • SSDEEP

      96:lJC/3zjNPMMQIQBmajlyM3px6D3t1KO4vNoHyJ:l0iAM3vlO4vNcyJ

    Score
    3/10
    • Target

      sqlite-autoconf-3440200/aclocal.m4

    • Size

      364KB

    • MD5

      6f9e7a7b0ab591c27b3cbf01a3c1036a

    • SHA1

      1f464e1017c18769c630a1d4fbfe9acd57a303ec

    • SHA256

      a459cf9e72aa3bf51c748226e37c2e192144047e3b1a5173119b92fa62f2bf82

    • SHA512

      aa0aec1a3442ecf4bbcdb908f32d72803e0988ca0b3d6ebaf32a49a2a898328c3bb71cf77ca3b062d55ccec9d86953fa52ddf02460d7724de09a4efb38d8ef7d

    • SSDEEP

      6144:tdAwSQSqrgHFnOvwYAU9FWgi/2WDg5+YaNk56cHrYw+Zg+XrZsGEREYRGAFU25tt:rAtM7E0LQNnc

    Score
    3/10
    • Target

      sqlite-autoconf-3440200/configure

    • Size

      485KB

    • MD5

      a3cfbb77ff42001bb363783c3b2dd261

    • SHA1

      9b222ed32dd27dc2b2bba00e7c2fbd1a0ac5974d

    • SHA256

      e4fd1a4c97d06f37d55eadf277cbcc62f01bf505c743ae50db90117457042c20

    • SHA512

      6e6a70a449d52ebe05b74124ba47476764bc3c0d640b3f32d6f9b46fe31b1842fb469792705215627398c88e0f0a0f64f1590e438f0bce92bedca1c68ebb0cd5

    • SSDEEP

      6144:X0hKTRerWD0QrR482PTxJToVL6APIudUVQUszNr3+5c+D+hmCk7XDSy+va++XYK4:ChKIJ3C1IJ4p5Z7H1eAvySpjxhH

    Score
    1/10
    • Target

      sqlite-autoconf-3440200/ltmain.sh

    • Size

      319KB

    • MD5

      494ed41316779107d9303766fdf58f71

    • SHA1

      7cb19264e70ff41fb066214c9b4d45a6c32621d8

    • SHA256

      0f01592875edd61a11373d84a298cd6f5c1a8006db66fe5c864225b9e91a4dcf

    • SHA512

      c2e2b154fbc02ad7e4531c0d5b6ae8362599bce77c07a7ca9371b2d6e547c538d5db7916cc7553db34e9506e99c620e15769d61647de789c20af618e15a8b220

    • SSDEEP

      6144:DMiSRge9MWrCom5FzLQmoMuMBhmQpteZyUjJjasyp/pCZl+JRKT2MBFpfJYTt/WC:IBnj+hC+

    Score
    3/10
    • Target

      sqlite-autoconf-3440200/tea/configure

    • Size

      275KB

    • MD5

      ba5ffb178cf74194bdf1f6e5ece117b5

    • SHA1

      267d0ac6fa31d8a3b645569bf70df76d6c81bfe2

    • SHA256

      2e8ee257c6a2775f2c8df3175b3afe6e25a5a4d857e5006a98b5f8a1c0f3a2f0

    • SHA512

      9b6c30cc5727bb0123af7cf0d695bea540d7515446fcba1579876be11e715d960f4d3dfe0cade156ceb2f330796008540b3507cf3d532dc0288dcc863aed6678

    • SSDEEP

      6144:80hKTRxrWDmQre482PTxJToVLsoIudUWpJUszNr3+51DSAe5+3eufSMowzenwgrc:w9IsZouin

    Score
    1/10
    • Target

      sqlite-autoconf-3440200/tea/win/makefile.vc

    • Size

      14KB

    • MD5

      d65d541180534651aba597fa129689e8

    • SHA1

      14f6a79b9158c04f704d9d5d8a61049aabdd119a

    • SHA256

      e07b6d1e7f1bcbefe7b060529c6ee9e4c0dc931d588976f8dff02615ebbdf2b8

    • SHA512

      ba0b2a2f1f9f38c0e9bc8cfc4425ca81c12963b1d63ce1491e815784037f7c7e71bf9aab296fdadb5d62116eb49242590a70ee3da621da27200c6b705188604e

    • SSDEEP

      192:ygr3J3pvyDWVPwHjJ3bVNnmPpqn92wMi2l4POby:yg7Fpv96jJ3ZNnmPplw4QIy

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
7/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

discovery
Score
3/10

behavioral29

Score
3/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10