General
- Target AIMr-AI-Launcher_202026.exe
- Size 134.8MB
- Sample260629-bc5pmsaz6n
- SHA256 e2db57c5d3a6b5acb7770ce42f9783aa4320f95cea58002021dd495a8d19257d
Malware Config
Targets
-
- Target AIMr-AI-Launcher_202026.exe
- Size 134.8MB
- SHA256 e2db57c5d3a6b5acb7770ce42f9783aa4320f95cea58002021dd495a8d19257d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MicroCom.Runtime.dll
- Size 16KB
- SHA256 2e0a43be3d123dae5aa8a7f1082fd3f1c2a8d842f6c513deac526daed620e318
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Data.Sqlite.dll
- Size 173KB
- SHA256 4ffa9156ebb9332bc53196cde2e62997447ad046629216be555e07d5d65f6c19
Score1/10 -
- Target Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
Score1/10 -
- Target Microsoft.Extensions.Logging.Abstractions.dll
- Size 63KB
- SHA256 bb853130f5afaf335be7858d661f8212ec653835100f5a4e3aa2c66a4d4f685d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.IO.RecyclableMemoryStream.dll
- Size 64KB
- SHA256 631a5fc41df9498d032c0655ebd0e1209430ccffbec55667d89c2566b338ccc0
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Win32.SystemEvents.dll
- Size 59KB
- SHA256 f4117352b3d086777a6b343005cf83a6f3ce10233576a4cc1ee3a9f7c857a6b8
Score1/10 -
- Target Microsoft.Windows.SDK.NET.dll
- Size 24.9MB
- SHA256 2891aee0893bc66ca2d9d781f1ea84017bbb7d80700e31fb6e8c0bc48490fa09
Score1/10 -
- Target Newtonsoft.Json.dll
- Size 706KB
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
Score1/10 -
- Target OpenTK.Audio.OpenAL.dll
- Size 87KB
- SHA256 f99dae9e1f6829bbd3203080b26061657e59eba0da963a5fd47b0566b0e99619
Score1/10 -
- Target OpenTK.Compute.dll
- Size 45KB
- SHA256 2e959e7f8f61ad673ea2c48474eed04ca0808242b68d0c3d6f4fd891e2dbf056
Score1/10 -
- Target OpenTK.Core.dll
- Size 8KB
- SHA256 dfc33091256ad113de3fe8abf4f9dedea05e05d10e0778f49e19bf9e74053de8
Score1/10 -
- Target OpenTK.GLControl.dll
- Size 27KB
- SHA256 244aa51d89af2a8320848e84210733eaceab88335c5204d99d5e72f96caa9976
Score1/10 -
- Target OpenTK.Graphics.dll
- Size 4.3MB
- SHA256 8e863cc9c1271007ab9224c8eba63908fa931689c88b6cb0e8aa63859a6d4c2e
Score1/10 -
- Target OpenTK.Input.dll
- Size 8KB
- SHA256 1e9b290f4092f1eae6d67e1f78e8e2caf2d3ff11a60131a8542258a0cc335b34
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target OpenTK.Mathematics.dll
- Size 308KB
- SHA256 352c412e73d2775629ec867ec2752fb4ae9ae6e0bb21ec55b9e3825d53e22141
Score1/10