Overview

overview

9

Static

static

3

GIR-Form-0...64.exe

windows10-2004-x64

9

GIR-Form-0...64.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

resources/...42.dll

windows10-2004-x64

1

resources/...42.dll

windows11-ltsc_2024-x64

1

resources/....3.dll

windows10-2004-x64

1

resources/....3.dll

windows11-ltsc_2024-x64

8

resources/...64.dll

windows10-2004-x64

1

resources/...64.dll

windows11-ltsc_2024-x64

8

resources/...vc.dll

windows10-2004-x64

1

resources/...vc.dll

windows11-ltsc_2024-x64

1

resources/...trc.js

windows10-2004-x64

3

resources/...trc.js

windows11-ltsc_2024-x64

3

resources/...eps.js

windows10-2004-x64

3

resources/...eps.js

windows11-ltsc_2024-x64

3

resources/...zip.js

windows10-2004-x64

3

resources/...zip.js

windows11-ltsc_2024-x64

3

resources/...min.js

windows10-2004-x64

3

resources/...min.js

windows11-ltsc_2024-x64

3

resources/...ph.svg

windows10-2004-x64

3

resources/...ph.svg

windows11-ltsc_2024-x64

4

resources/...e64.js

windows10-2004-x64

3

resources/...e64.js

windows11-ltsc_2024-x64

3

resources/...min.js

windows10-2004-x64

3

resources/...min.js

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    GIR-Form-0.1.22-win-x64.exe
  • Size 182.2MB
  • Sample260622-rf1svscy9w
  • SHA256 0161ef4274f791e34b2b85c41eb3e1baf518f01c162fe84ce7990cc35529eadc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target
      GIR-Form-0.1.22-win-x64.exe
    • Size 182.2MB
    • SHA256 0161ef4274f791e34b2b85c41eb3e1baf518f01c162fe84ce7990cc35529eadc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecutionransomwarespywarestealeradwarepersistence

    • Renames multiple (203) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to get system information.

      execution
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      resources/app.asar.unpacked/node_modules/@img/sharp-win32-x64/lib/libvips-42.dll
    • Size 18.2MB
    • SHA256 f8d356def73941668252347b825055310e99023ff77c7d3036e592d0771e1529
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      resources/app.asar.unpacked/node_modules/@img/sharp-win32-x64/lib/libvips-cpp-8.17.3.dll
    • Size 319KB
    • SHA256 f1b3c3eeea1b6a8292a69d78dd2cd1debacb9951cabdd9217a57e34137570cd1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14
    • Target
      resources/app.asar.unpacked/node_modules/@img/sharp-win32-x64/lib/sharp-win32-x64.node
    • Size 423KB
    • SHA256 afc813593f255968ddae8f1d66557e0f96484bb374606e4eb2267a7dbc7cb25a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral15behavioral16
    • Target
      resources/app.asar.unpacked/node_modules/@next/swc-win32-x64-msvc/next-swc.win32-x64-msvc.node
    • Size 130.5MB
    • SHA256 81588961b073664ffb5ddbf667107f78df72c907be3bf43ef496ba6c4d0727a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      resources/app.asar.unpacked/node_modules/jszip/.eslintrc.js
    • Size 896B
    • SHA256 0ddfbda0c594ca371f67baaa166734f5075d34ef56fdd2984f574564843c2a66
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      resources/app.asar.unpacked/node_modules/jszip/deps.js
    • Size 1KB
    • SHA256 35b1b517365d5935151333ef8b57048261b79573b765e96e5ba69aa0cc05a8bb
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      resources/app.asar.unpacked/node_modules/jszip/dist/jszip.js
    • Size 365KB
    • SHA256 e2e1be5c22d3f15b0b89e676d3eede94644529996d9898a6b1587c9908a78506
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/jszip/dist/jszip.min.js
    • Size 95KB
    • SHA256 acc7e41455a80765b5fd9c7ee1b8078a6d160bbbca455aeae854de65c947d59e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      resources/app.asar.unpacked/node_modules/jszip/graph.svg
    • Size 44KB
    • SHA256 4ee632fe1845c8981cf958f30a34b585ccd1d6562d8f1657938a67ca4d25e6af
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral27behavioral28
    • Target
      resources/app.asar.unpacked/node_modules/jszip/lib/base64.js
    • Size 3KB
    • SHA256 5df6b73d9ed6c317c67835f3427d860c16fd93acf503eb471fd897167e747fdb
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      resources/app/.next/standalone/.next/node_modules/@react-pdf/renderer-5f716e9bc7d68b8a/lib/react-pdf.browser.min.js
    • Size 5KB
    • SHA256 01d09d9570a16b1e17ae8e7501f22d35346175eeb1f712407b1d1f9457b5c216
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Defense Evasion

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

7
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionransomwarespywarestealer
Score
9/10

behavioral2

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

adwarepersistenceransomwarespyware
Score
8/10

behavioral15

Score
1/10

behavioral16

adwarepersistenceransomwarespyware
Score
8/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

adwarediscoveryspyware
Score
3/10

behavioral28

adwarediscoveryspyware
Score
4/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

adwareexecutionpersistenceransomwarespyware
Score
8/10