General
- Target Era Setup 1.0.120.exe
- Size 146.0MB
- Sample260629-dlaa7sby5v
- SHA256 8e15a6f861aaa8e93bb26d192f6f7cf7bca9a7538b734f1bccb5c4074ffaa1ed
Malware Config
Targets
-
- Target Era Setup 1.0.120.exe
- Size 146.0MB
- SHA256 8e15a6f861aaa8e93bb26d192f6f7cf7bca9a7538b734f1bccb5c4074ffaa1ed
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 145.2MB
- SHA256 a450031048f659055895a7b5b2e6e38330b612b9d7321884253d947c966f3bc6
Score7/10-
Executes dropped EXE
-
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target chrome_100_percent.pak
- Size 112KB
- SHA256 45d14a4278b1e152b363197401a5604aa5a3cee6512a6b52df978038fa521a0f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target chrome_200_percent.pak
- Size 182KB
- SHA256 aafc61b89748d17fcbc9fecd9844a77be2c584529a81714c98e0c4d453ea9496
Score3/10 -
- Target icudtl.dat
- Size 10.0MB
- SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/af.pak
- Size 567KB
- SHA256 ebfdf1ca739f74b0b58a7965094274523fe2deb44fa0afff5bed98635b70326a
Score3/10 -
- Target locales/th.pak
- Size 1.2MB
- SHA256 45a573589f11c1694490913c00bbff65d57e232d33ca2270ac2e443207b971d2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
- Size 8.4MB
- SHA256 afbcd1d671e55c567212f1ded3870fee4d5ca4624fd1016d4f615c8775db48f7
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-140/register-scheme.node
- Size 131KB
- SHA256 2987d5fb0bfd8caddc01020f43b0afebbec60d7b492c4b03fad81f03ff4eed7b
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 131KB
- SHA256 2987d5fb0bfd8caddc01020f43b0afebbec60d7b492c4b03fad81f03ff4eed7b
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/register-scheme/index.js
- Size 91B
- SHA256 9740d6b8f1290751808b9474175259aabd1cce2064ea6496b900b8bd9e1a6cb3
Score3/10