bd1980fdf4955c41373a4684e5d5a342ac53aa57631fc1075488b93c4337339b

Sharing

Copy URL Twitter E-mail

General

Target
Triggers-Client-win-x64.exe
Size 102.7MB
Sample260602-vamwlab19k
SHA256 bd1980fdf4955c41373a4684e5d5a342ac53aa57631fc1075488b93c4337339b
MD5 c1c86d416fb7e37228b6f08f1855e41a
SHA1 25774ad30eb95b7f2b48e60620261ab196c443f1
SHA512 11a42f7202d779ea004c7fa663f396ad375ffdfb0fec781302092f289619a60a083e011d37f4b43d50958fc6f9209f2881971ae271bacb698c55453c38c6c39f
SSDEEP 3145728:4d982HGrJ/clTfOhMAl7OF2sNnBbxdQHl:e9nkaNfOhMg7uPRuHl
TLSH
T112383376A142C38FD44D84B8C580EDFAE6C67E66CE4D3D03F4907A1E74B9B0A53DA642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Triggers-Client-win-x64.exe
- Size 102.7MB
- SHA256 bd1980fdf4955c41373a4684e5d5a342ac53aa57631fc1075488b93c4337339b
- MD5 c1c86d416fb7e37228b6f08f1855e41a
- SHA1 25774ad30eb95b7f2b48e60620261ab196c443f1
- SHA512 11a42f7202d779ea004c7fa663f396ad375ffdfb0fec781302092f289619a60a083e011d37f4b43d50958fc6f9209f2881971ae271bacb698c55453c38c6c39f
- SSDEEP 3145728:4d982HGrJ/clTfOhMAl7OF2sNnBbxdQHl:e9nkaNfOhMg7uPRuHl
- TLSH
  T112383376A142C38FD44D84B8C580EDFAE6C67E66CE4D3D03F4907A1E74B9B0A53DA642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 14.6MB
- SHA256 6965e1b04dc81a012981508299e28542abff2bc7f418071c264f0b53e0c63f34
- MD5 3575333bc14b9a3c05160d72de394b00
- SHA1 159b59188618949fc7f646a381aad69753ae500e
- SHA512 d5f7bfa24bed869758e68ad62316dea7c74aad9873fc25a40f99b9216fe4d6ea6207269940f4c210ae0abc46116558ce1f95b78b1f857040db3d84d5b607fdc0
- SSDEEP 24576:f8Bd/jZ6JocjZ6X1jZ6QCjK6D0HwRiuTumfUKjr6ZjK6yjr6mjK6ajK6XjK6QjRv:f8KOe8rn8mVRx2
- TLSH
  T177F6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/@tailwindcss/oxide-win32-x64-msvc/tailwindcss-oxide.win32-x64-msvc.node
- Size 3.1MB
- SHA256 d0aa887d95f0b8f2d58ee4cbb1f297d013bc6d11a77cfa50c4fa706c20840055
- MD5 16cfd372b91e6c1cc9c83a7ca763fa4b
- SHA1 4fefced6299f88b75e053edf8571447f27694fe2
- SHA512 2f43db34f42f94aec195de6e65c2fb400e09eae11f8fc50baff735314c7f6b6fb36936c7e8e3c97f8a65930bd4384743d567d77d9dca310d96db1e4ed566c818
- SSDEEP 49152:GtWwUumRGip6JyasB/ZNbFWOuEQDS0fEjnjpx/kA:3hZNFzlcwNkA
- TLSH
  T169E53A12BE9799ADC59AC874870B4A631A21B4CB0B36B9FF41C441393F69BF11B3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/build/Release/bufferutil.node
- Size 151KB
- SHA256 17f5d7cb3d403f0a3db42744d7959f1420c60dfc59f77354dcbe00d442869b9c
- MD5 2eb15cf820fce9c9ff350143d344f01b
- SHA1 a52896e67c76877bc8ecd87d4ad60559a2133048
- SHA512 d1df48347d18b4530375f1eb8b8f014d23bc832eb1d964ee47c0b3ce83a69818a285b3b1a7beba7567d8b2c322a87a30cdebc67eef373a6bfe19f962230271d0
- SSDEEP 3072:oBz1SW/r8RXjiQT/qe4/YwBoQj8H5KVLQzDVv:iw3BknYEofF
- TLSH
  T150E35C5BB3E500BBE5B7867989A34646E772781107209BEF03A4437A2F237D15D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/fallback.js
- Size 899B
- SHA256 f4a65d1a98db49439616119fba09be0d9a4217af57b21282ab7b91c8b5a082b9
- MD5 e7225196819df0032629fa873f3a6a47
- SHA1 2e089facf7a2df11e50f693565c810b9de0e4095
- SHA512 56b89a7aff78fe2a231f3622804461e41ad67ebb87ef2eba4dc75cf0b1cfec769318fbabf7f2bd2c701b7beae3856a38d226905d16be7353199d215dd5758191
- TLSH
  T166118C6F6F14126D0407F7D581859E8F42344724F3EBE988853E7D210DDDA614EB2CD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/index.js
- Size 136B
- SHA256 70846a43c2bd3b1077461563194e4d2407b18e7d767d6fd8785ea9b7d6ddd044
- MD5 4ce2ef7ae60266e7ee9f8a4078117193
- SHA1 a11314facf16ceba23abf556cfd3a13264a3e390
- SHA512 840f27524a2b576ba11631beb55940473b74f540dcc5fcad058b47e5c0a137fea946555041224fb6ef1c1fbf2704d01ffc6a046c7352dca45e7b55d2acc00df9
- TLSH
  T1CCC02BEB0CFDBA8312D5C143E160861360CEC090084C4401C75807C303C0C880B93DA2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-ia32/bufferutil.node
- Size 126KB
- SHA256 d3cc72764c09f4b2a7f885f5167811fd22dd3728b59bb1a18fa5a6f504317689
- MD5 788a615b21988f3643ac21a8669c72a4
- SHA1 1e74df3e1215bbd035817e73e8f6b9dbd0f8a064
- SHA512 72987562ca9cbfe5dd513081f8d961bb66672d4bdf0e28a411ad870c6c0942b9602a9a22e6674b13b121f821ceaff371bb3fd6105ccab6eb5320ff5df3c311e8
- SSDEEP 3072:xcVDS9QbSK27JKr/AS9SaJWAGk52TpYndT+6FSGVJr:OVeaZIJ8/AS9Sag1k5cw4GVJ
- TLSH
  T1E8C38D41B5D0C031D4BD19390928CBB59B3E7970DFA48DCB67941ABA9F302C1DF36A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/win32-x64/bufferutil.node
- Size 151KB
- SHA256 9bf6ec4d84b75403a50f22d9bdba2cfb287f12472374c9d5eb736c963a997ee9
- MD5 21452ef6b0cd9fbfbdb622b50c2adaaa
- SHA1 2bc5f964994ab2077796849a4b544b550e2145ea
- SHA512 a9b53bc1f2ec0afac2e3609fd53330aeec4c21f46bec0d96af2922e17e88dd56f8761228d391efe093399deb6d3ed9cb6e0f7358bfd311635474388c25317b3f
- SSDEEP 3072:AU2S5EUeVT4H4i4T/qB1YwTeQrZSmwVZwNRNScC:Xr5UxkPYOeKUF
- TLSH
  T1EBE35C47B3E500BBE1B79679C9A34646E772781107609BEF03A443762F233D19E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/lightningcss-win32-x64-msvc/lightningcss.win32-x64-msvc.node
- Size 9.1MB
- SHA256 83e7e838ef1bbf5454c651103574fec31a1cec0b453b999d1173365cbc6c7841
- MD5 d347b8e5dd6154cfd2886ffb03879752
- SHA1 19e0e82ac44d4ecc76e555421b7d6f5a0291bca9
- SHA512 b281b64bd032db64ab37141bba6e7e3c7b4799efcea1bfdd2283e2b52b85208f08c1c6dd6eab02d7ec9dd6ad64bc5c6959abb55e123e51f6113e89c3df3ccb7c
- SSDEEP 98304:jLL2MeOL9AEwjmeSPmeAmz0OUEr/jDaGPqeAkeZ/ud/p:KXYwCekGWapkrp
- TLSH
  T120A62A06E2B391E9C46DC47193576233FA317C8A8635BAEB4BD04B322F65F906A3D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 147KB
- SHA256 f8ddce8e27913c42f6d81381db48ff45a41550b3140f2fb614b965568ba82d21
- MD5 cea94b450e544843748b3d0955a6018e
- SHA1 7878c17f7c3a2502fa793badfb518f476ebafba2
- SHA512 c630aee85aa67dfe494b61d855b534d49509f0b64e61451550490c22140438c23e028e41806af0b2b91549694ffff59f22080f85362280dd9d219259055be0d8
- SSDEEP 3072:w7qANrvm90f0+aYpdkUlHsTfRhthmuFa:R2ThpPxsTfzF
- TLSH
  T1D6E36C5BB2A100BBE577C238CD635A46E77278520760ABDF03A843752F233D19D7AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/index.js
- Size 91B
- SHA256 9740d6b8f1290751808b9474175259aabd1cce2064ea6496b900b8bd9e1a6cb3
- MD5 72c672f572f5bc3185b3dc87a245123d
- SHA1 dcd3be3fcfcdb2bfb4e4ed04ec8b04d430ea5833
- SHA512 bb2569d1a9a8d41350058863ee8cb8c066a2046092d93e7268b48574dfc4b9bc54513b3ca9dce10a75a71400ab9c2149334f243e44b62700b0f11e1bef9f1cc4
- TLSH
  T130B0124DD046E2DB27C420C8AC625403894EC111803045C1A304D7C40CA64C05102960
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/utf-8-validate/fallback.js
- Size 1KB
- SHA256 74ad313e48d1008cf20e4ad691f883319be8baaff4442d86796819fb4d7969cd
- MD5 8ef7300c1c722fa879a08ad91aa6b5ba
- SHA1 b433b379a86afd5097c30b13a87e53fdb520e321
- SHA512 efb74434a74eb69d290f510128cef51bf0827ebef4f1269e45785ff8411ddb86ab780596c36890c91ee5c7bfc1801b29448c9be34039aa13946836052684d88e
- TLSH
  T11E3105C9949335714BA3E569CED5980A221888E731586A08FC8D3E80DFF4270D663ECF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32