General

  • Target

    Flux Setup 1.0.83.exe

  • Size

    100.0MB

  • Sample

    241121-af2xgswnhs

  • MD5

    405a033317cd59781ff25d6512284ed3

  • SHA1

    069d928bfbcf7aeee625708143485621382f2866

  • SHA256

    3a6fb161d92cda9d5cc9399073070393ac23afd27684a08d2ce6f84586c72f20

  • SHA512

    c9fd4cbd5b90400e5649be7f3b81072beb4e8bccb954963cc1e4b48272225dc2c978828b10e933c494775099d6f8f90a4bbbe8cee836068a91f150ac12baab42

  • SSDEEP

    1572864:It4opqebTEWRCrJnR0sD7GHv9xFJgHaXOTqPLk8rDbDkkagQkpIEDG5oiP2Wo6gM:ItHlb7QJRnDQzFJsNH8nkkagQfroU2RQ

Malware Config

Targets

    • Target

      Flux Setup 1.0.83.exe

    • Size

      100.0MB

    • MD5

      405a033317cd59781ff25d6512284ed3

    • SHA1

      069d928bfbcf7aeee625708143485621382f2866

    • SHA256

      3a6fb161d92cda9d5cc9399073070393ac23afd27684a08d2ce6f84586c72f20

    • SHA512

      c9fd4cbd5b90400e5649be7f3b81072beb4e8bccb954963cc1e4b48272225dc2c978828b10e933c494775099d6f8f90a4bbbe8cee836068a91f150ac12baab42

    • SSDEEP

      1572864:It4opqebTEWRCrJnR0sD7GHv9xFJgHaXOTqPLk8rDbDkkagQkpIEDG5oiP2Wo6gM:ItHlb7QJRnDQzFJsNH8nkkagQfroU2RQ

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    3/10
    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    • Target

      Flux.exe

    • Size

      154.5MB

    • MD5

      87278673be7f80f2fbfc5dc51d4cd83d

    • SHA1

      19c05e365d15da1705cb6e057eb74ff7c1340ddc

    • SHA256

      e3ee85f2d8fd1496cff031965769c6222cae8ffc66c52e0f8e832ff0d5e2e831

    • SHA512

      0ecdd4568faf37f6aac7a9c41381a9e0ebbb36496fbfcc8a832ffb2c470c24cfdfbea17c2086eb22578e636b098ddb9170821070be91b02a98ed617088e5f4df

    • SSDEEP

      1572864:1CquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:xDAgZi

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Target

      LICENSES.chromium.html

    • Size

      6.5MB

    • MD5

      180f8acc70405077badc751453d13625

    • SHA1

      35dc54acad60a98aeec47c7ade3e6a8c81f06883

    • SHA256

      0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c

    • SHA512

      40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec

    • SSDEEP

      24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj

    Score
    3/10
    • Target

      binaries/FortniteLauncher.exe

    • Size

      52KB

    • MD5

      aeaa6f47b71614437c0d47828da005ca

    • SHA1

      f9d016d3817ebbc28556967b8b8c05d120acbc58

    • SHA256

      31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66

    • SHA512

      6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60

    • SSDEEP

      768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb

    Score
    1/10
    • Target

      binaries/vulcan.exe

    • Size

      83.4MB

    • MD5

      852265419e7d45c999833da73a893b98

    • SHA1

      9fb9d95cf6bec2653d4fad4cd3e5d79b9366c9c7

    • SHA256

      2e1bb038a933dd45d99c1db563895e39a97985ad09fc6df473db69025d545320

    • SHA512

      76c8f0c85dbcdec702fd6c3b99a4e27110fa71b28e646a05ef9515e10b0a7e2d7b1bde84b37ea350f5a4472930db17671d4c11207183fe151252a6cef257c3f8

    • SSDEEP

      393216:SHiF+q20mzccIxl0UrOAdSP6XBCBnIOGq2h9Yg2ftV5kwVAliXUxbblHa93Whlit:SCc6c41KAd9XBmIOsmtBNBb

    Score
    1/10
    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      cb9807f6cf55ad799e920b7e0f97df99

    • SHA1

      bb76012ded5acd103adad49436612d073d159b29

    • SHA256

      5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

    • SHA512

      f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

    • SSDEEP

      49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI

    Score
    1/10
    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      d49e7a8f096ad4722bd0f6963e0efc08

    • SHA1

      6835f12391023c0c7e3c8cc37b0496e3a93a5985

    • SHA256

      f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014

    • SHA512

      ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575

    • SSDEEP

      49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW

    Score
    1/10
    • Target

      libEGL.dll

    • Size

      468KB

    • MD5

      09134e6b407083baaedf9a8c0bce68f2

    • SHA1

      8847344cceeab35c1cdf8637af9bd59671b4e97d

    • SHA256

      d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577

    • SHA512

      6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba

    • SSDEEP

      12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX

    Score
    1/10
    • Target

      libGLESv2.dll

    • Size

      7.2MB

    • MD5

      a5f1921e6dcde9eaf42e2ccc82b3d353

    • SHA1

      1f6f4df99ae475acec4a7d3910badb26c15919d1

    • SHA256

      50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e

    • SHA512

      0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702

    • SSDEEP

      98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi

    Score
    1/10
    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/bin/sentry-cli

    • Size

      487B

    • MD5

      b7c89ec5dfb8b15555f32a3bef6c3103

    • SHA1

      a92048052f5fc0af532cd97ebf82c1a9fbf12342

    • SHA256

      7c5c97aaee075241bdc4fbc610b356445747e962ac3d986c5016acefd66a6ea0

    • SHA512

      c47baa0e0896684403760a13cfa6dd5826152ec7ae83f783040d186eaca8af70bc97530bbb22b720d7482a4ad18c3959ab1af8ccfe3689b19a51955e777884e8

    Score
    4/10
    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/helper.js

    • Size

      6KB

    • MD5

      c29ad60a23d5406728a51afa4352b4c7

    • SHA1

      2be817215890f5868717765570ce9f7422735c4e

    • SHA256

      faa867204c92db252271c9d850962ae1ff5c9448444ca907af483a6c874a6eb0

    • SHA512

      e1784b8bf7119bf3380b192f1597cb3179425ff7ab347b144011fd17b62794760e6e092a0a1dae99302eb6c333f1638440df4e4e0eaf64f26d4f3cc46a74d04a

    • SSDEEP

      192:WSqkCoOycfhxPBRw/uL2FqRxJRLVeUdrga:WSbCoOycfhJBR+qjRx/VeQMa

    Score
    3/10
    • Target

      resources/app.asar.unpacked/node_modules/@sentry/cli/js/index.js

    • Size

      1KB

    • MD5

      50c3a734036b84685a15d56217207d67

    • SHA1

      1893de2684072a3a2961337fa9a9b45a52c52c0a

    • SHA256

      171990f108cd5582f83432c1569f2c3e1aebfbfb159599f4ff2ab693c20a8f78

    • SHA512

      3aa037d12cee7cbf51826fb3e2aa87b4543dd62f5ff5f2f8915128061c07472304601766bddf949647c5ca92e8ee768a77139bbe91bdfaaae99dea4405168ea9

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

Score
7/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

discovery
Score
3/10

behavioral27

antivmdiscovery
Score
4/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10