General
- Target ledger-live-desktop-2.70.0-sha.92ace1745cc3a01484573a9d91ed0841fd770480-win-x64 (1).exe
- Size 124.1MB
- Sample260623-1elf8agv9z
- SHA256 d38241aaa6308ef9f79ca6ba87b8f903fd4aa2f44307a45076d0c244fb5c544c
Malware Config
Targets
-
- Target ledger-live-desktop-2.70.0-sha.92ace1745cc3a01484573a9d91ed0841fd770480-win-x64 (1).exe
- Size 124.1MB
- SHA256 d38241aaa6308ef9f79ca6ba87b8f903fd4aa2f44307a45076d0c244fb5c544c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSES.chromium.html
- Size 7.9MB
- SHA256 6bb288835bc59b4550338d8034ef8fb9f05714e890ec08c327149c82142cb4ea
Score4/10 -
- Target Ledger Live Beta.exe
- Size 155.8MB
- SHA256 76151bb3449ee759a4b92455eb960dfa083ab2b8c97fa597e1e3735def8ad60a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 5b59ea0a14b7046a142dfb4d45870c609d6d7fb4bff0471221430e6aad07814c
Score1/10 -
- Target libEGL.dll
- Size 469KB
- SHA256 a213e78577d5a49cc58e3c47664c9a8681ea45a7b5d49bba395f8445eca9b963
Score1/10 -
- Target libGLESv2.dll
- Size 7.1MB
- SHA256 f5773168236c190fa8672ecf4a79e4b93bc36751b65631c1fb4e1ab981e3c681
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vk_swiftshader.dll
- Size 5.0MB
- SHA256 371fd2064d669a833d30129af855d6890d3a8e91382f9a9d8fb75f39fce74ace
Score1/10 -
- Target vulkan-1.dll
- Size 910KB
- SHA256 749a7e840894096fce59565c323d17ba3d6194540f7f139e23ab0bb53710f100
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
Score3/10