Overview
overview
7Static
static
3XrayInject1.2.exe
windows7-x64
7XrayInject1.2.exe
windows10-2004-x64
$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3LNpSUHD317.exe
windows10-2004-x64
d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...pi.dll
windows7-x64
1resources/...pi.dll
windows10-2004-x64
1resources/...e3.dll
windows7-x64
1resources/...e3.dll
windows10-2004-x64
1resources/...act.js
windows7-x64
3resources/...act.js
windows10-2004-x64
3sqlite-aut...ace.js
windows7-x64
3sqlite-aut...ace.js
windows10-2004-x64
3sqlite-aut...al.ps1
windows7-x64
3sqlite-aut...al.ps1
windows10-2004-x64
3sqlite-aut...re.vbs
windows7-x64
1sqlite-aut...re.vbs
windows10-2004-x64
1sqlite-aut...ain.sh
windows7-x64
3sqlite-aut...ain.sh
windows10-2004-x64
3sqlite-aut...re.vbs
windows7-x64
1sqlite-aut...re.vbs
windows10-2004-x64
1sqlite-aut...le.vbs
windows7-x64
1General
-
Target
XrayInject1.2.exe
-
Size
81.0MB
-
Sample
241113-y6ermssjdp
-
MD5
d8f10b83e6923f5d41c6b44156ad5dde
-
SHA1
2ce44d3146d62be6e9d8c671c717d1d2e4c85310
-
SHA256
599eb6a50a0c7b170a6d7736433cb408c7f935448efffc6171ced9ec5d25f690
-
SHA512
fa2eed9886bc9a2f8984752793deb5eb981db76238a139909060ffced0b5ed2e92e6cf9d592d223f1a02f676f6299f6716409cd09504220aa65787abcd0a3e28
-
SSDEEP
1572864:iSnyk/h70iyDDdzIYQLSocpaefLTPn6l/JrRzXkTQykT6udmBXqc7:ieybDD1t/zrLTPn6l/JlmkWudmFqc7
Static task
static1
Behavioral task
behavioral1
Sample
XrayInject1.2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XrayInject1.2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
LNpSUHD317.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
d3dcompiler_47.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.dll
Resource
win7-20241010-en
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.dll
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
sqlite-autoconf-3440200/Replace.js
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
sqlite-autoconf-3440200/Replace.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
sqlite-autoconf-3440200/aclocal.ps1
Resource
win7-20240729-en
Behavioral task
behavioral25
Sample
sqlite-autoconf-3440200/aclocal.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
sqlite-autoconf-3440200/configure.vbs
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
sqlite-autoconf-3440200/configure.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
sqlite-autoconf-3440200/ltmain.sh
Resource
win7-20241010-en
Behavioral task
behavioral29
Sample
sqlite-autoconf-3440200/ltmain.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
sqlite-autoconf-3440200/tea/configure.vbs
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
sqlite-autoconf-3440200/tea/configure.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
sqlite-autoconf-3440200/tea/win/makefile.vbs
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
XrayInject1.2.exe
-
Size
81.0MB
-
MD5
d8f10b83e6923f5d41c6b44156ad5dde
-
SHA1
2ce44d3146d62be6e9d8c671c717d1d2e4c85310
-
SHA256
599eb6a50a0c7b170a6d7736433cb408c7f935448efffc6171ced9ec5d25f690
-
SHA512
fa2eed9886bc9a2f8984752793deb5eb981db76238a139909060ffced0b5ed2e92e6cf9d592d223f1a02f676f6299f6716409cd09504220aa65787abcd0a3e28
-
SSDEEP
1572864:iSnyk/h70iyDDdzIYQLSocpaefLTPn6l/JrRzXkTQykT6udmBXqc7:ieybDD1t/zrLTPn6l/JlmkWudmFqc7
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-
-
-
Target
$PLUGINSDIR/StdUtils.dll
-
Size
100KB
-
MD5
c6a6e03f77c313b267498515488c5740
-
SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15
-
SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
-
SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
SSDEEP
3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
0d7ad4f45dc6f5aa87f606d0331c6901
-
SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457
-
SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
-
SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
SSDEEP
192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score3/10 -
-
-
Target
LICENSES.chromium.html
-
Size
9.0MB
-
MD5
f90bec233251fd8b0cec0a2aa45be071
-
SHA1
9af25a284eb14f1a8d5e67fd91d7f963d7a9c3d6
-
SHA256
1479be3660c7ebfa60813d7ce9c5f017d25946ef762b3f1cc571180b25151e48
-
SHA512
23dec29517ff7ab9999462211844d369f5f7e582037914d1be98af3bf43c41417a27c32314507d19d37d87d9acc4c8da085948794cfe32689dba7a2e0a393b04
-
SSDEEP
24576:G8QQf6Ox6j1newR6Xe1Vmf66k6T6W6r656+eGj7dOp+:fGoeGd
Score3/10 -
-
-
Target
LNpSUHD317.exe
-
Size
177.6MB
-
MD5
5b7459d6d91a51dabfe9d021ff8bbf4a
-
SHA1
49ab5e90730130ab9eb201ee8430a069dd8948d9
-
SHA256
290229164fc6b0bc5bb69e77e672c8e0120740d39fefa5f69eea6d1163c3de0f
-
SHA512
d9a134502d079a72c4a5eb9615ad77e10285887b3d28147c38e8077bc851b26989f36076837a3d5c0a24d3c2381083aa84ede2fd19068f9145c3f566c211e4a7
-
SSDEEP
1572864:fNvGCNRixbPlrp4MpeU4cpVblbtHvJb7ZlBS3bQiOFx++/305WNejZlqE6N0okBN:fmbJBrh5c
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates processes with tasklist
-
-
-
Target
d3dcompiler_47.dll
-
Size
4.7MB
-
MD5
a7b7470c347f84365ffe1b2072b4f95c
-
SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3
-
SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
-
SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
-
SSDEEP
49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
Score1/10 -
-
-
Target
ffmpeg.dll
-
Size
2.8MB
-
MD5
60bc255d5ddd8fc9c8be4c82108a2c8b
-
SHA1
ad1a0606f27d95608e02d6ad0c40b342008d8f24
-
SHA256
cd0ccc24489532a6c6e977ea4d25250d9850a395b51c46f90b47ed21ef8044ba
-
SHA512
fc50c39cdcf60a622cd4b63490c9ef2b4e3897acc05b25e900bff5d351431628e8141048995deb28de270b002d67a3976a4b528a5b50b5d1cac6683f48f1fb38
-
SSDEEP
49152:bshioTdyDPLVt7Spx275ydSNTGuNt+X6Cf2B+J6/VTTfV:bseVtsx29ywBGuB/T
Score1/10 -
-
-
Target
libEGL.dll
-
Size
473KB
-
MD5
998ccce35f45d91eda0fbf2272923b03
-
SHA1
9c99a7a8e4dec171cc0499e229730a241c164fbf
-
SHA256
ad75ac7d0fe26ee9665c075e705d290233732feb897173597a18887b3d1cad7b
-
SHA512
b5cf010ccfe4083d83e5c3c8df144bbf30eef991ac2f91f081562cf7e2b4182447cc4f86508fbd1ec229a6a34ab1907c861276776d8f657f557cea2ff7b3003e
-
SSDEEP
6144:KL1WWZ6zNA2dOUq3lfxGtcLDMx28ARKNrdZHXOb/sk4siui:uWQwZWlwtcLDm+KN7HXOb/sk40
Score1/10 -
-
-
Target
libGLESv2.dll
-
Size
8.0MB
-
MD5
06d7890e8f5423bf90a02137af53d95b
-
SHA1
980f746f895bef998bb78d7adaccddfab6a9aa5b
-
SHA256
586a04652de1a392e8f0c4cc69ece9b7370be4953b9fa4019d09207578324e42
-
SHA512
bad64ac5761e2db7a9453b731c10ba13409aa8793c7e82d56c48c6231f923debb960f89d92eb69ca2914283b85d4102e8e1ec38cb7bf3d1009fc390b45ccd605
-
SSDEEP
98304:s6VTc3DGigGJ7rDYaLjrBccGmTlc5eWXLXC3PIvd:s6VTc3DGLo7B7DGmJWTmQvd
Score1/10 -
-
-
Target
resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
-
Size
412B
-
MD5
0b33e83d33b01a51625a0fdcbef42ce3
-
SHA1
1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
-
SHA256
a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
-
SHA512
1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
Score3/10 -
-
-
Target
resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
-
Size
137KB
-
MD5
04bfbfec8db966420fe4c7b85ebb506a
-
SHA1
939bb742a354a92e1dcd3661a62d69e48030a335
-
SHA256
da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
-
SHA512
4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
-
SSDEEP
3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
Score1/10 -
-
-
Target
resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
-
Size
1.8MB
-
MD5
66a65322c9d362a23cf3d3f7735d5430
-
SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e
-
SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
-
SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
-
SSDEEP
49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
Score1/10 -
-
-
Target
resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
-
Size
224B
-
MD5
f0a82a6a6043bf87899114337c67df6c
-
SHA1
a906c146eb0a359742ff85c1d96a095bd0dd95fd
-
SHA256
5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
-
SHA512
d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
Score3/10 -
-
-
Target
sqlite-autoconf-3440200/Replace.cs
-
Size
7KB
-
MD5
335ee30449b5d0d52ab314dbff93d52f
-
SHA1
02c67258801c2fb5f63231e0ac0f220b4b36ba91
-
SHA256
74ba0687a84c328df2836f73d7d36368099a5f5c1c360a84211e51fa71f1dfc0
-
SHA512
02f40bc955c833105811f78471e29f062c1cebfe4bd96ffba941670c0026ad5bbc81f336b7c2c6b9f804c67ed46c9dabab927ec0fb4c709bd7a049454f27073a
-
SSDEEP
96:lJC/3zjNPMMQIQBmajlyM3px6D3t1KO4vNoHyJ:l0iAM3vlO4vNcyJ
Score3/10 -
-
-
Target
sqlite-autoconf-3440200/aclocal.m4
-
Size
364KB
-
MD5
6f9e7a7b0ab591c27b3cbf01a3c1036a
-
SHA1
1f464e1017c18769c630a1d4fbfe9acd57a303ec
-
SHA256
a459cf9e72aa3bf51c748226e37c2e192144047e3b1a5173119b92fa62f2bf82
-
SHA512
aa0aec1a3442ecf4bbcdb908f32d72803e0988ca0b3d6ebaf32a49a2a898328c3bb71cf77ca3b062d55ccec9d86953fa52ddf02460d7724de09a4efb38d8ef7d
-
SSDEEP
6144:tdAwSQSqrgHFnOvwYAU9FWgi/2WDg5+YaNk56cHrYw+Zg+XrZsGEREYRGAFU25tt:rAtM7E0LQNnc
Score3/10 -
-
-
Target
sqlite-autoconf-3440200/configure
-
Size
485KB
-
MD5
a3cfbb77ff42001bb363783c3b2dd261
-
SHA1
9b222ed32dd27dc2b2bba00e7c2fbd1a0ac5974d
-
SHA256
e4fd1a4c97d06f37d55eadf277cbcc62f01bf505c743ae50db90117457042c20
-
SHA512
6e6a70a449d52ebe05b74124ba47476764bc3c0d640b3f32d6f9b46fe31b1842fb469792705215627398c88e0f0a0f64f1590e438f0bce92bedca1c68ebb0cd5
-
SSDEEP
6144:X0hKTRerWD0QrR482PTxJToVL6APIudUVQUszNr3+5c+D+hmCk7XDSy+va++XYK4:ChKIJ3C1IJ4p5Z7H1eAvySpjxhH
Score1/10 -
-
-
Target
sqlite-autoconf-3440200/ltmain.sh
-
Size
319KB
-
MD5
494ed41316779107d9303766fdf58f71
-
SHA1
7cb19264e70ff41fb066214c9b4d45a6c32621d8
-
SHA256
0f01592875edd61a11373d84a298cd6f5c1a8006db66fe5c864225b9e91a4dcf
-
SHA512
c2e2b154fbc02ad7e4531c0d5b6ae8362599bce77c07a7ca9371b2d6e547c538d5db7916cc7553db34e9506e99c620e15769d61647de789c20af618e15a8b220
-
SSDEEP
6144:DMiSRge9MWrCom5FzLQmoMuMBhmQpteZyUjJjasyp/pCZl+JRKT2MBFpfJYTt/WC:IBnj+hC+
Score3/10 -
-
-
Target
sqlite-autoconf-3440200/tea/configure
-
Size
275KB
-
MD5
ba5ffb178cf74194bdf1f6e5ece117b5
-
SHA1
267d0ac6fa31d8a3b645569bf70df76d6c81bfe2
-
SHA256
2e8ee257c6a2775f2c8df3175b3afe6e25a5a4d857e5006a98b5f8a1c0f3a2f0
-
SHA512
9b6c30cc5727bb0123af7cf0d695bea540d7515446fcba1579876be11e715d960f4d3dfe0cade156ceb2f330796008540b3507cf3d532dc0288dcc863aed6678
-
SSDEEP
6144:80hKTRxrWDmQre482PTxJToVLsoIudUWpJUszNr3+51DSAe5+3eufSMowzenwgrc:w9IsZouin
Score1/10 -
-
-
Target
sqlite-autoconf-3440200/tea/win/makefile.vc
-
Size
14KB
-
MD5
d65d541180534651aba597fa129689e8
-
SHA1
14f6a79b9158c04f704d9d5d8a61049aabdd119a
-
SHA256
e07b6d1e7f1bcbefe7b060529c6ee9e4c0dc931d588976f8dff02615ebbdf2b8
-
SHA512
ba0b2a2f1f9f38c0e9bc8cfc4425ca81c12963b1d63ce1491e815784037f7c7e71bf9aab296fdadb5d62116eb49242590a70ee3da621da27200c6b705188604e
-
SSDEEP
192:ygr3J3pvyDWVPwHjJ3bVNnmPpqn92wMi2l4POby:yg7Fpv96jJ3ZNnmPplw4QIy
Score1/10 -