General
- Target Privacy.Browser.Setup.1.0.0.exe
- Size 143.9MB
- Sample260622-py935sb18m
- SHA256 986fc3830ef332c18a43a1fd9e633ecb1411ff12dd0f4cc162a40fd2d9449191
Malware Config
Targets
-
- Target Privacy.Browser.Setup.1.0.0.exe
- Size 143.9MB
- SHA256 986fc3830ef332c18a43a1fd9e633ecb1411ff12dd0f4cc162a40fd2d9449191
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
Score4/10 -
- Target Privacy Browser.exe
- Size 134.2MB
- SHA256 a8c1f7d29ca77fd1f66653790f84fdf632ab1e77657baf71ac0d2aad5f65eed8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target d3dcompiler_47.dll
- Size 3.9MB
- SHA256 35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
Score3/10 -
- Target ffmpeg.dll
- Size 2.4MB
- SHA256 88b7467f97fc9b3f0d3fc97508448ad71c987dc451265e6e4b64717827b64a4e
Score3/10 -
- Target resources/assets/icons/icon.svg
- Size 742B
- SHA256 67ac08f34c5eb0a6bb81abb44cf2e24e13309876deb888a31806338dc6678c56
Score4/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 4.4MB
- SHA256 7ca00d10f18573e32daaf3776ebf63edf27c13f249782de0f485f8e0195b2421
Score3/10 -
- Target vulkan-1.dll
- Size 803KB
- SHA256 0edc95e7633025b080a2866f1556f61c6b2230bf5498987de8f92334f7edc149
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 c8476ee68088d72b9fab25703093df19237d14387016b77f472e10c99c9415ed
Score1/10 -
- Target libEGL.dll
- Size 467KB
- SHA256 7bee4e33d89e5a4f2b3bc74d632f7c773ae9a399b6b2ba6d29b1192e25695a8b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.