1a61aaf91e1880dd1bea7456103275d91c19d555479cc89c5a3bf9e89b14198f

Sharing

Copy URL Twitter E-mail

General

Target
OctoLauncher_Installer.exe
Size 68.2MB
Sample260608-vga6dact81
SHA256 1a61aaf91e1880dd1bea7456103275d91c19d555479cc89c5a3bf9e89b14198f
MD5 c120a5ebd2f68689905afb9975076ba6
SHA1 f0854fb7af9ad6adb7530a46224c81b63c21c1d7
SHA512 400117c200d51d6da16bbef5a9d44c62a1f5dc001184a91d0a020f847a44e5ddd9d75437ef5fb9efdba5aad73083667abd06e244ef05c31071e47c853f3e6d2f
SSDEEP 1572864:woE4gDFmBESR59Qi4UBtskWns7Zb41EwbL3A7q5i0nEKkPKwEYZ/:woE4iFmSSNQi4UUBns7O1EwbMGQJZ/
TLSH
T150F733661B04E99ED66A2974A6F5181E9BBDC59B09472B238F7BDCB4E378FD43F00040
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  OctoLauncher_Installer.exe
- Size 68.2MB
- SHA256 1a61aaf91e1880dd1bea7456103275d91c19d555479cc89c5a3bf9e89b14198f
- MD5 c120a5ebd2f68689905afb9975076ba6
- SHA1 f0854fb7af9ad6adb7530a46224c81b63c21c1d7
- SHA512 400117c200d51d6da16bbef5a9d44c62a1f5dc001184a91d0a020f847a44e5ddd9d75437ef5fb9efdba5aad73083667abd06e244ef05c31071e47c853f3e6d2f
- SSDEEP 1572864:woE4gDFmBESR59Qi4UBtskWns7Zb41EwbL3A7q5i0nEKkPKwEYZ/:woE4iFmSSNQi4UUBns7O1EwbMGQJZ/
- TLSH
  T150F733661B04E99ED66A2974A6F5181E9BBDC59B09472B238F7BDCB4E378FD43F00040
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4218ee7a02556cf4a925f79957e3e157c54ef236a22208464406c88031695f1b
- MD5 51f1baa7fee261d4a7d7f188c0cf7502
- SHA1 ad414b2046101e49b5c74d2cac96be782f50570c
- SHA512 b9ca5d7bfff98c07c7ffafade7e3cb3da0c7dc63bb2ff4e8da3223ddb46a9e972fa3540ab86bb4c2e2309966af38cb5572f8f4bd54c8528a4c36789773a8a98c
- SSDEEP 49152:6F5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQNSCu:6FvSkJXv+tiLAD0+DNS5
- TLSH
  T12CD5AE07E6DA40D9D01EC070879FA233F62134468B24A7EF1A9196252F7BFD46E3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 477KB
- SHA256 d421431e5390d9e1a9f3d75c987d8cb73bb47e81208f0320bda1a945dede8939
- MD5 24d21aafc8df659211ef982beb29c2f0
- SHA1 7196fc5dd9a4cfcb5c828d86bc333f422e1e3587
- SHA512 a6f1f5435be3bf37aebd8060d258a1e4c09b467d26034fdc7b2b1d3e63cba0e03f7ab733f616616708e0f4efd2aae9aef8d191c7beebdeb71e5ca6792a6fbd2c
- SSDEEP 6144:S8hd1BSjuMmof2SEXVVfgV8hxN7h2N0IEOg51f0FticyQ:S8DXSjZmof2SEsmN12N0IE7f0FticyQ
- TLSH
  T11DA47C15B79844A9E07BC470CA534652EE62B4960F65FADF0394923D2F7BBF81B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 6572e621800f308de46fc60b5a615e015119410d3f1c260ce1750e4de81e91d1
- MD5 b62eda9bcf73a1205eba62ba1e58dfed
- SHA1 a8663b78fb7897acaba6e6e73d1e1c00b0a8b7fc
- SHA512 42d1f4f1e3762060869933a9c3b6176650579a20238097c52c7d6a9904f01ce327527c0607cf9a00c7b66944c1461975c15aa6fca18e0ce4703a5fd99ba2fadf
- SSDEEP 98304:+nbalIu/BrsXHXnvV9AcDoyGDHnSHQZ3rW:+nGG0BMXBDerr
- TLSH
  T1D2768D13F69640D9D05DC2B8DB579533FA31B8950B30B2CF2A9427212F7ABE06B7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/node_modules/dll-inject/build/Release/injector.node
- Size 116KB
- SHA256 d68555bc824252c26bc28decc4271a20e99dcc0318c88d73ea5211eacfef6694
- MD5 8461fa114d5ebbabe67d258e48ac0fac
- SHA1 8522307b001a2f1c50284e6bb655790df84a093a
- SHA512 e08a46d1c3989a91762c7a1e8061ba2a78e654c643356c70309cc036109d4c6ede5988308a854ae9d165d04ae75456eee6429dc4c0dc14c06dd790f6c41a9061
- SSDEEP 3072:jA3IzSvfQCaj0YUsgxw4B//OWO+DrPT45xLdV9W8f:jgpvfQnHKw4J/OYbaxLr9V
- TLSH
  T1C9C35B5BB3E900BBE477827884A34A45D773B84107619FEF43A4825A1F637D19D3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/dll-inject/index.js
- Size 117B
- SHA256 133f4238f4ab150eabfa825ca61edbb71624f7c1cbce734fd6409ed097d8631d
- MD5 e7c0e8969ffcb1e5ca9432bf1b2f9e18
- SHA1 140a15834ea7b3ebb1f2c897189de11d2dd8b201
- SHA512 177124fc7fa27d276f15bcd9049f18bca51dd2791eecbc6faa61a5c1ca5342b8738929401e609d1a5063d65c0ac9201c0d39adc499ac2441fa393edf0bdf8821
- TLSH
  T1F7B092D161F1F81B23E6A050E8A4C213E8D184B30647D2B8A419C6BE1E44A80239D86E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/dll-inject/testdll.dll
- Size 56KB
- SHA256 8679050123315f813cb95262a7d4b5bf37230fe9d29d62131103172c33bcee92
- MD5 722680e52f81ccb585d84d464aef3b3f
- SHA1 70ffbd59b04333ddb7de04516c03c681ad340d97
- SHA512 05cae5c54daeea848119e25b3ff3b8ce32bb3ee1125e82d0de871a08a457b72e6534514410c667005fdca0bc76d1df88e85a146a76f560a9e4e15dfd68bc0926
- SSDEEP 384:xMVW7lMVGT3LxbzMod5aSDq+T8Cq1ia+wNOJBs4JXrALH9ib:xaulbzeCq1zOU4JeH
- TLSH
  T1E043E64BBBA960FBD076C23EAAD21229B6B1702013715BCB114549391F63BEC3C7E795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/stormlib-node/dist/StormLib.dll
- Size 511KB
- SHA256 4a0ee9aa632dedaa8cdc748c1d3b9a0f3751bceeff399c3601f784962ea277b0
- MD5 6dfe62c60aba5f30e1a069ec5a8974f6
- SHA1 4d2b711d9bc128e27a79f4be5aa1cd7ce58075da
- SHA512 418db95275f2cd276d2f1d036656b1cc58f6b74281d62206598ce66204fb00f4b062b224f076a2be0dcb933d08b4df4de1fab84439b45c596a5a73f15111ee83
- SSDEEP 12288:bODpb9f0p0s+JpOAQUEvHKhFEZS54SULp7HNMG8DGxz0+olluO2jZ7YFb/T6QtYi:bODpb98p0s+JpOAQUEvHKhFEZS54SULQ
- TLSH
  T1FCB49E41F3E55BE8D577C2788563861BF6B1B80913509BEF13A49A7A2F13BE0573A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/stormlib-node/dist/enums.js
- Size 9KB
- SHA256 16cf8030e9b193d7d37952be096b453408730dc85a1b07e5ed54fb646ca8bb21
- MD5 03d7bcab51b89ff6286d42570fc4677f
- SHA1 8d2f48dbc57d3b498af0fbb5148ac5830e80433f
- SHA512 3e36e7b0861fa821416b87d0fa8cd63a370b9bc491537e20a4d994b7c70e15f304fbb3d150818ccb2a6c2aec84144a6e768c06da8f92bfb2dc90d2e2c4db047b
- SSDEEP 192:Ksg3dEYQjDk0+HVOy87KZXcAOp2bV9jQdPW9uW3ildX2+lMQbw6v0vdNl8o6y1iO:qtaq1CmZBRqXzLEk6Na7LdQ
- TLSH
  T1A612621E7DDD222B096F0CF0630DE284E721965F73B0898C34AE43396F35A554BF6A69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/node_modules/stormlib-node/dist/stormlib.node
- Size 560KB
- SHA256 e7bb42674cd890699fd68ccf6889c9414c98659b00a590a6b1be6f53824acc71
- MD5 b5f16b44c7c8853852febce383b498ed
- SHA1 e622fd67f1612909a07db27f12892a438e1ab9be
- SHA512 80c5905e5853deba3394956661da6e9127ab8f23be79f5128934d29dc935f70619cdf9fc96a95de348fc91c5e9f65bda26a25da8de9a418f8b63cd24aef3cad2
- SSDEEP 12288:u+Gnk7VoY1dLZRvheFEHvXozEyvB+KWzlkhsSIjNcGL2IT+X0N6Tpiuaz:uFk7VoudLZRvheFEHvXozEyvB+KWzlkM
- TLSH
  T1DAC48D46F3E506F8C0B7C178C6539616F7B2741513605AEF17909ABA2F23BE05B3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/stormlib-node/lib/StormLib.dll
- Size 511KB
- SHA256 4a0ee9aa632dedaa8cdc748c1d3b9a0f3751bceeff399c3601f784962ea277b0
- MD5 6dfe62c60aba5f30e1a069ec5a8974f6
- SHA1 4d2b711d9bc128e27a79f4be5aa1cd7ce58075da
- SHA512 418db95275f2cd276d2f1d036656b1cc58f6b74281d62206598ce66204fb00f4b062b224f076a2be0dcb933d08b4df4de1fab84439b45c596a5a73f15111ee83
- SSDEEP 12288:bODpb9f0p0s+JpOAQUEvHKhFEZS54SULp7HNMG8DGxz0+olluO2jZ7YFb/T6QtYi:bODpb98p0s+JpOAQUEvHKhFEZS54SULQ
- TLSH
  T1FCB49E41F3E55BE8D577C2788563861BF6B1B80913509BEF13A49A7A2F13BE0573A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/stormlib-node/scripts/compile.js
- Size 2KB
- SHA256 583c2aca80cc5d767fa181616d927f2846a2840491f131ec9e6bae99d6dbad1d
- MD5 9b20f3d1613d2ebee0b51bb098a1b05c
- SHA1 6f56fd6161f570f4dab523b48b8dd6dab23ef523
- SHA512 043aeae8c82ccfd1c94d73d377ddc6fc99bca0fe5f308d78d3ecef58f02be556764aa6932f26bcd644f937d70e7432a57be6f602f3d7ee78304beea30bc8851f
- TLSH
  T15E419B9561BF07713A733A838E2741177A2664136202A95CBEBCC24E1F8156A53F3FF8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32