9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a

Sharing

Copy URL Twitter E-mail

General

Target
Wave-Setup (1).exe
Size 125.7MB
Sample241120-raf69ssldk
SHA256 9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a
MD5 83b9582724795067e20130359bfb1c73
SHA1 b15af3e93cadfdf3c7ef1da8abe30326c614858b
SHA512 e0513ccd5a7af6af150f87401c18807066073c6cd38abcd9cc43c8d1a6e49bf09e316554436c142a2e9188c66f34d80221099b1b135b161197b003a16196477b
SSDEEP 3145728:12Jkdx1xzhntUuzeaSyAPgdg3ib33ohJH69WfKNZLZM+tpw5zRS:mkb1xFyuzdSyANib33ovaNZLI5M
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Wave-Setup (1).exe
- Size 125.7MB
- SHA256 9450dafe9611c073d06b5f7dc8a11659217ba80a5566dd7c12161f87b80b265a
- MD5 83b9582724795067e20130359bfb1c73
- SHA1 b15af3e93cadfdf3c7ef1da8abe30326c614858b
- SHA512 e0513ccd5a7af6af150f87401c18807066073c6cd38abcd9cc43c8d1a6e49bf09e316554436c142a2e9188c66f34d80221099b1b135b161197b003a16196477b
- SSDEEP 3145728:12Jkdx1xzhntUuzeaSyAPgdg3ib33ohJH69WfKNZLZM+tpw5zRS:mkb1xFyuzdSyANib33ovaNZLI5M
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 9.0MB
- SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
- MD5 ae174699b663bd90d8d06c68c6952477
- SHA1 8c76eda61d320779909adc541593b8e26b24815a
- SHA512 3fb72dcd790464dde34978c9d0895376827f4d839b4a199c6e9fe77ab810d62b960babc4b21f6e189dc70147b5fb4334815730f4d1cdec05489c19e0725c2158
- SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmfh6k6T6W6r656+eGj/dBIp+:oAPeGLp
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/nodemon/bin/nodemon.js
- Size 436B
- SHA256 9bb0e59dfd1cc00fc40bed0ccf10d88414d915d79875b9dee5c1d5009f4e89cf
- MD5 30894042a167528293c057f833e7b6f2
- SHA1 ec993fedf1f1a22c77b985c72d8b0074811ea680
- SHA512 2b544b29e44e0471a9da5474209bc15cb81a44a38448a74a7a67f4ed3ca7d1926cef4b2b13d3269fb785a468d00f1cfc042d2a7d6b4d563725da65028e2df15f
- MD5 SHA1 SHA512
Score

4^/10

discovery execution antivm
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/nodemon/bin/windows-kill.exe
- Size 78KB
- SHA256 d35c0d3af8f66984b1ead5cb56744049c1d71ef0791383250ad1086c0e21f865
- MD5 de5ecb14c8a2212beb309284b5a62aae
- SHA1 cf89d1cbd52f3183590b33bd6be591f95a6f5291
- SHA512 fea8a49538f5fd4cb8c262c1619f9f8e906edeef7d3c791bd3b85f032a0499aa5f18b4370a00e1f4dab9698e1958b042cab467103598f1bdaa583eb1fb918c07
- SSDEEP 768:AzE0/Tw0orfubmn3b7mX69Ne4xfX6irumhSA3eVqT3l8:43ZBm3b7mX6aO6Ds
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/index.js
- Size 1KB
- SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
- MD5 05d07534c94e2d589bcc02e96e1b9503
- SHA1 3c3712ecff74a1099c4d65e4eefd9cf2e38f1119
- SHA512 7c7526f2b4e685cc7e20689ebe5abf7630b738d2d15ab7b5e94765e0e6f221492e9e029f715f5b3ac156d3d11ffd907e070d2d7f968b5f5fb401aa9c7ec84ea5
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/cli/parse.js
- Size 5KB
- SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
- MD5 63db540f7184a372ac611fc3d7f21136
- SHA1 0b3a8e70600a6705297a532849b7470c34f8c19e
- SHA512 1f56bbc4856fbefd21f6de0738712157b91f1388a71a957c37444b617ee161885822b21fcf4e7efe14d5af54b9706d8181acbb286dbd7525c91a56b53dc391be
- SSDEEP 96:+6TvjlNAJQppvvTa3USVOMXWKtxr0rTARlmDk1d9PATBVXTcYbhwn4Fq:phNAkjSVOMGQ0rT9Dk1daDX1i4Fq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/command.js
- Size 1KB
- SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
- MD5 90c1aa9f031e818373c2f2f7ed6b9dbe
- SHA1 b6476cdfa45ab967436ba9bb32aac1d65e531a9f
- SHA512 4ee766da766530bb372d8e04b058edd6b28ca5d77f603b175336e9b5e8f5c677e77e0ea4afc07a642c07c48e0c209716dbd9cef4f6ab97864a9ea51af2b49bbc
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/defaults.js
- Size 979B
- SHA256 2b577f3fd8e3d03d64c1ee07ef13db89df04d0a9cf7b69ebf2c17041f7251104
- MD5 2e6f9c975170db8136c9ca5c5ecf2a0c
- SHA1 404a2c64977cae3407aa138c23a2f841546f713d
- SHA512 15bfa9fad522ddc043383704cac725c8cc2b4565708b891e9e03d889237cd528ee4d347e54a983c801550856c2d1ac1269dcc127edfa6d63bf3d2aa0a19eb358
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/exec.js
- Size 6KB
- SHA256 fcd713c63326ff75fc44afdcbd2bf63991c3c76169a26a2646defab46ce24155
- MD5 efcab0a70d5e71fb513734cf92f2a201
- SHA1 aa55660d5d6a38e2ea632d4de0640ad2b1b7fc5a
- SHA512 260a468807d297c2fe85ce8341ae10be64a7833a8249f2932c6a93e6ade07438ca4bd26222326a1b0e3203ba0c80a6a6fb78e90015b667feda8f68538e1011ad
- SSDEEP 192:JbY5kVR4x435efvxZRuSaCqiXNkNvCAoI1huLNINowq5bu:JbYtapefpZRuSDmvCAThu8q5i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/index.js
- Size 2KB
- SHA256 be155df5dbc29c88c67c936f2840d2bb3abd09981fdb6db6480d54beeb27e9fe
- MD5 ac3af2f96d2e824bc37e36e30cb35cad
- SHA1 d04e50eb9464ee715a940819ac7af1b612884bb4
- SHA512 060bc19e10d8b9cd959869866b4ac5e0739edd72ca1e61a230a5f3c735feda6fb75ae7a8ea13349013082bedbcd40e30219ca09ccfaad43571059a765bcaee8c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/nodemon/lib/config/load.js
- Size 6KB
- SHA256 7329c732d39f8e884c0ec197e1133c536545bf4137417e6d664bbec962990e29
- MD5 3379b8830f56cd13355114f157e57857
- SHA1 cec1a9f2c8ca7f666cb4efc2f3eb99317ea59602
- SHA512 0690be21833aa598da0d7d20312ee8a2e2ecaf164981c94c3bb12036cea40a206e1b25e839209db78419d6262ae87e29a5c94f583ddd9b45e05bc5a107842d22
- SSDEEP 192:0nZm6KJjPFt3zucWXistTMUFhBi833PoajJIDHDaswh1Ou8tfZCnb:0nZmVjOcWPhBi+iY15b
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks for any installed AV software in registry

Checks installed software on the system

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32