General
- Target Walftech Fix Setup 2.3.1.exe
- Size 74.9MB
- Sample260701-s364tsbt41
- SHA256 3eecf1d883ac9c7581935c81c0f01eae81e80ccb57dcbfeb90ce4989b80d7cf6
Malware Config
Targets
-
- Target Walftech Fix Setup 2.3.1.exe
- Size 74.9MB
- SHA256 3eecf1d883ac9c7581935c81c0f01eae81e80ccb57dcbfeb90ce4989b80d7cf6
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 74.3MB
- SHA256 3381f4648f3ac8cc4c30cfdf5d65f6d0eab9666aa6c44d227b22917ab6b39f1a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score1/10 -
- Target chrome_100_percent.pak
- Size 148KB
- SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
Score3/10 -
- Target chrome_200_percent.pak
- Size 223KB
- SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target icudtl.dat
- Size 10.0MB
- SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
Score3/10 -
- Target locales/af.pak
- Size 494KB
- SHA256 e2470090a09ca500679e68bb5e3b1acc35a5873fea4f93af25a23c82122f2c13
Score3/10 -
- Target locales/am.pak
- Size 800KB
- SHA256 4e15946e86a578eeff41feda808bb291d81e240fbdfc96cbe2efe692ad35eef5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/ar.pak
- Size 874KB
- SHA256 5cc02570e5f61cbca791309985df3a29584e41583b3344f1d9fb6b04ce423e6f
Score3/10 -
- Target locales/bg.pak
- Size 913KB
- SHA256 97ef7984074775282b68dca5d5a469efdb2b22474ee6669fdfb5197d3f1b3768
Score3/10 -
- Target locales/bn.pak
- Size 1.1MB
- SHA256 1aba82aee8c985e5e370e7cf2b35c9ec20cbe5174db5fcb54ec7d19ec5d79587
Score3/10 -
- Target resources/app.asar
- Size 464KB
- SHA256 d78e3164a591970293d00bf336e44a86b63c90a822613dca221d33a05caacbd8
Score3/10