General
- Target Avogadro2-2.0.0-win64.exe
- Size 115.2MB
- Sample260702-br3tlahs6k
- SHA256 6b2748d55a6e95674bec00baf8c2ad48ecc8dad28c8d25252f68b39bdd9b1bff
Malware Config
Targets
-
- Target Avogadro2-2.0.0-win64.exe
- Size 115.2MB
- SHA256 6b2748d55a6e95674bec00baf8c2ad48ecc8dad28c8d25252f68b39bdd9b1bff
Score6/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score3/10 -
- Target bin/AvogadroCalc.dll
- Size 197KB
- SHA256 3828bc51bd2d1c8e6c0fef13dfc1e86530c23b8ccd7f1214bbb078e0bfee730c
Score1/10 -
- Target bin/AvogadroCore.dll
- Size 1.1MB
- SHA256 5b15b133a58d8139f3c029bdf359539a0ef032e3b7398933d317a09690dd1e7d
Score1/10 -
- Target bin/AvogadroIO.dll
- Size 695KB
- SHA256 46dc922aaff01ce3765466c5ef33c265153ebf4a36ce5256f39d5162cec91321
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/AvogadroMoleQueue.dll
- Size 343KB
- SHA256 d0b084a8665f2e4dc6f7337b10875fdeb3bf55dad9407d1684d83fce936e08ec
Score1/10 -
- Target bin/AvogadroQtGui.dll
- Size 963KB
- SHA256 d0a7ff606ae6e0e6cd8631c45cc2e978efe04d3caa37877c9f2f5c728a7c43b0
Score1/10 -
- Target bin/AvogadroQtOpenGL.dll
- Size 66KB
- SHA256 81dae1064731036857d10f004d49bcba7e4ad9a8b43ec0bece10f74e7d53ade8
Score1/10 -
- Target bin/AvogadroQtPlugins.dll
- Size 3.5MB
- SHA256 c541efcd39a536ea00b3efbf999bed6be0acbc979adf682b81cb78c0f39e38be
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/AvogadroQuantumIO.dll
- Size 478KB
- SHA256 075f21347a3f50964d4ff4001ed2693549612b0d8cebc404ccea6fbd62a1fae6
Score1/10 -
- Target bin/AvogadroRendering.dll
- Size 394KB
- SHA256 18bbc9972f30a75da88f5186437dda13a141c5f77ff61ebbb37c785efb7fdaf3
Score1/10 -
- Target bin/JKQTCommon6_Release.dll
- Size 1.1MB
- SHA256 76fab3d0320535d10898772aef5db803cd10a40e57a929a8fa681bebf1021e09
Score1/10 -
- Target bin/JKQTMath6_Release.dll
- Size 324KB
- SHA256 5d994d462b431be13b7cfb7fea04d68337abc6b67e35834e0165aadc2f6bc43f
Score1/10 -
- Target bin/JKQTMathText6_Release.dll
- Size 2.9MB
- SHA256 2747b9018583ee5ea9ff51b5a8ddd96cf1e3dfa0abfa950f72b802497c17dcae
Score1/10 -
- Target bin/JKQTPlotter6_Release.dll
- Size 4.3MB
- SHA256 1c654116b5fc68733e5885df4c116c63579929213b1e88c93ac0f2c585962ee8
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.