General
- Target OTP_Bot_Setup.exe
- Size 83.4MB
- Sample260428-vyn4kact61
- SHA256 05c235bc36b8003026f6bf4803d3c4b680819cc5d31eceb997942298ecb35ee6
Malware Config
Targets
-
- Target OTP_Bot_Setup.exe
- Size 83.4MB
- SHA256 05c235bc36b8003026f6bf4803d3c4b680819cc5d31eceb997942298ecb35ee6
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
Score1/10 -
- Target dxcompiler.dll
- Size 24.9MB
- SHA256 6f02237496ce3d04459539c530521e6ae2aa05dc6e3f669769898e604b8d5dd7
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 e8ef0c488acde7242b318b7babf6e45297a57ec968abd700f989d6269bf36831
Score1/10 -
- Target libEGL.dll
- Size 492KB
- SHA256 cc90ee15962abb35fcc409b854de08b2e640b5aa44c9211be3eafca43917074b
Score1/10 -
- Target libGLESv2.dll
- Size 8.0MB
- SHA256 273e0c34c3511fa793eb8c7a30623218c530c01668640d890a70d8c77a5a9466
Score1/10 -
- Target resources/app.asar
- Size 143KB
- SHA256 39007b6e58e93ea27b9c51b66f9adac0ce6f6f2b4a462bb871c608eb7bcd8326
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target updater.exe
- Size 201.1MB
- SHA256 5547b725f6b811a41467ec66eec2994df045edbfd3bec6406a9cc767f05d7f11
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
-
- Target vk_swiftshader.dll
- Size 5.4MB
- SHA256 1df00e64394fa563016ec1885271e4665d5813da5f9d1ce910d71d9a090e5d81
Score1/10 -
- Target vulkan-1.dll
- Size 922KB
- SHA256 e6663e25b7380f110166e194eff87257bb25a2a7455037e9e0f33bebeabd1d6e
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1