General
- Target Cloudnet.zip
- Size 82.6MB
- Sample260620-q8t1caft7m
- SHA256 407d2abf86bc7fd825db9dfc7fcfd872a2da13208a2bb16b676e11c08562c828
Malware Config
Targets
-
- Target A3DLIBS.dll
- Size 846KB
- SHA256 945ee95d7da31d4184572c33a3eb6cf34cbde403db968fb11719ea32c0d55af1
Score1/10 -
- Target CRClient.dll
- Size 326KB
- SHA256 dfda0d97560ce9d9f2052d2ae21ee01a71d2cc1e9848d98d99995439b9bad766
Score1/10 -
- Target Design.dll
- Size 75.6MB
- SHA256 1f0752bf3fc854b1d0cdbdb4bcd4f8a3bd9e68083a0d5d65ca8aea0776417227
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Launcher.exe
- Size 2.9MB
- SHA256 a0657b6cc937534d9dda18de95e41a108f6030d63ff3aa105b2fa78c8aac6af3
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target TfFontMgr.dll
- Size 228KB
- SHA256 620671cbd822c246844b447be29f39caa41695148b6dba25d13ad1a0d59e1057
Score1/10 -
- Target data1.bin
- Size 96KB
- SHA256 4d26ddd05425a14691acb84807525244adf6393cbf7f92837396b8afc86e31bd
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target drivers/CoolType.dll
- Size 4.0MB
- SHA256 9fb3d23d05e8240abdc60c97d0ffad13e140a167ef8264ff779fe7e499f6f3ca
Score1/10 -
- Target drivers/boost_system.dll
- Size 37KB
- SHA256 469e79a0dce89d512317876632c7268bd896960a2d79524763880e3a2c037f14
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 2d8ca4610564c38bf2f754c694295de7df1895238d89e066f19bb1d3d3c1bae3
Score1/10 -
- Target msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
Score1/10 -
- Target sqlite.dll
- Size 1.9MB
- SHA256 1595b10424c3a0ebd586fe16c54fff5d52ab33e9446355cb27022ddcbf8a4e98
Score1/10 -
- Target vcruntime140.dll
- Size 124KB
- SHA256 b1b933beee9a06842e29f0005bc7fa8b82626fb0922863f61eea9ca0491fbe40
Score1/10 -
- Target vcruntime140_1.dll
- Size 51KB
- SHA256 ae1dd66cf1345491f13d460b0580d2fb5c6b8e7a24bed440c7cee6318cc389ea
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2