6208391cc72e3943aa95d6aca5ad2120bbae984dfdacf1f2a7d13b2051dbdb23

Sharing

Copy URL Twitter E-mail

General

Target
STALCUBE_Setup.exe
Size 95.3MB
Sample260702-mcs7dset7q
SHA256 6208391cc72e3943aa95d6aca5ad2120bbae984dfdacf1f2a7d13b2051dbdb23
MD5 ec7d7fc8d7ce92284fb4f9a1045bd173
SHA1 e36e1867397053a58fd2bce04c5556d96b9ab85c
SHA512 15f0cafbdfb8bd7b8c5fff815ca6ffee27a167c62cfd51593073874af683e93d917d03983c2c9880c700cadee60cbbce907ed40dae1f2c6709c8fb824fbb5dfe
SSDEEP 1572864:gyu/U1RESsuvMDmVTVISYo/EeOwRMUY2D3zD53b1+ga+24UOIOxXZNldiEYzQUTD:gyqkSmtVYoKwRz1l3kgRMANlE9zTThrh
TLSH
T1D728336F7133C167C8224638B775D99998A403CB829DDEB77F0FD0B9A9A44FD0A120D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  STALCUBE_Setup.exe
- Size 95.3MB
- SHA256 6208391cc72e3943aa95d6aca5ad2120bbae984dfdacf1f2a7d13b2051dbdb23
- MD5 ec7d7fc8d7ce92284fb4f9a1045bd173
- SHA1 e36e1867397053a58fd2bce04c5556d96b9ab85c
- SHA512 15f0cafbdfb8bd7b8c5fff815ca6ffee27a167c62cfd51593073874af683e93d917d03983c2c9880c700cadee60cbbce907ed40dae1f2c6709c8fb824fbb5dfe
- SSDEEP 1572864:gyu/U1RESsuvMDmVTVISYo/EeOwRMUY2D3zD53b1+ga+24UOIOxXZNldiEYzQUTD:gyqkSmtVYoKwRz1l3kgRMANlE9zTThrh
- TLSH
  T1D728336F7133C167C8224638B775D99998A403CB829DDEB77F0FD0B9A9A44FD0A120D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
- MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
- SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
- SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
- SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
- TLSH
  T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libEGL.dll
- Size 470KB
- SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
- MD5 b12e3c1e72935273492da1daee50eef1
- SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
- SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
- SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
- TLSH
  T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
- MD5 5082e41d7a57506fe6b4bd58f87276b4
- SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
- SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
- SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
- TLSH
  T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/@napi-rs/nice-win32-x64-msvc/nice.win32-x64-msvc.node
- Size 227KB
- SHA256 310f9f72ea6665278111e3a457c7d36df5d373f701c365765007edd56a9c27a0
- MD5 12eb4689975b2e76f9d7452544411461
- SHA1 598946a1ca40256cb5eacf5dfed654f7bcfda90d
- SHA512 1ad9fa4d08b35d1bd75552eef70f07adeddb872ab0fe57a70bfe9626a40bc045fb53dcfe0918d3a9f5a4993456adc6da27cdd1b8bac7fa260742ebe013251339
- SSDEEP 6144:OdX2QptR4DxFZ1nXf7KYdaDlVtfbIzAUcDXy8agWEGkfGtVv/bC:A2URuxFZ1nXOYdaDlVtfbIzAUcDXydj7
- TLSH
  T11B34071575999CADE457C03893069FB2D632B08A4B21B9FB03D581363FAEBF42A3C745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/diskusage/build/Release/diskusage.node
- Size 173KB
- SHA256 80ab73bc53289794a00ef1904de39ea25a7d66447c465419e492a13ffb023cab
- MD5 31bb47ea4a4784a63dd59d37285e2774
- SHA1 7ed832dd6e5f0e3907eb388e33215111b2545c27
- SHA512 34e4cfd4591f6c244f4f07004d9565cef9d04a639d887dcdadef3422ecf5dcc50b771d162712c52245255c2426c2a33ab6ac7a4cf22aae771a4ab79ca7d28aff
- SSDEEP 3072:itMAQ3GDtmFN2fTC7LigVIiX6aynVyPyQZa2mLrU:itMF3IQ2r9iX6oyj24U
- TLSH
  T133047D4AF3F540BAE8B78239C9935906E77278150760ABEF07A043796F2B7D0593E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/diskusage/demo/index.js
- Size 923B
- SHA256 45a4bc8111be8bc7292df05830150f38de73dc026d8963b9c75955647fc0b308
- MD5 088a795504e82e9522f5f541345521eb
- SHA1 76eadb903fb87e5e015c7532daf5574c17d62b8a
- SHA512 6ca5d3a58f4b10b6b0db6921c210d79a17346f19c845d601482b81a830951e97f93718bab95502e3e34df99a3d23cb608df52296cd8a59f03b2b0355ddc6b1ff
- TLSH
  T1551176C08924267264753F66EA030029692B58962B5AB500BEDCA3E59F3FC222243DF9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/diskusage/fallback.js
- Size 677B
- SHA256 ba34dfcda1ececcfad1c14331b97391f37e875fca932167fd931ed380a74081a
- MD5 3f41fd929c3dbb89d2bf04908b3ea24a
- SHA1 50a36f15a0764a59d39c692277d04ad135c25c04
- SHA512 0e2b61f7894a09b9ddff1f339f881bada3add03195380a034afaa803f8c6a4f53c500989c4e9ae135c960bc0e38da52da48798324c86132392511852c37817c8
- TLSH
  T1850147DB0C93361A29B5F3B2260F010AF616C4A3072C5BA1F5E943611E66044638FCD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/diskusage/index.js
- Size 1KB
- SHA256 c87aa357fc676205fa60a6c0215738b0a261f7f7b1fb1f836231de38ef2d2abf
- MD5 77f8f61dd5589fcf93daa5f368e6ff3d
- SHA1 335ddc23af257b7a840974e3f9b2acf4c8564843
- SHA512 dfaa44bc8ed7102deed3244075b450fab2fdddb5642d6acefd65b496e672e2a47ece7103ac5bf6e4bfaed05d490427f4ed5a2f7cf646c6fe8d249c4cf4942aad
- TLSH
  T12021D2CB0C433155B8B6B376991B823AEB19A553021C5260F9ECA2711F3D0687A9FEDD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/diskusage/src/main.cpp
- Size 1KB
- SHA256 1d7b34b781d9da00887cbc9498ff675b0c464ee99d33038102447f9792458c19
- MD5 2abfbad00dd8c7df10a6d63e549f9df7
- SHA1 bffffecfc182300c003d85e0ced1ca709d7c0e29
- SHA512 1227c0fc3e4ff198a33d7abe88a321dc8eb9b0cdf833eafe3ed69c94a61b4e4cc3e7b196616461c1d057d2e5837394f9b1cc1ff4b45e26c253c9116c22bf7c7a
- TLSH
  T1602181AACB66B88F57BDA69C3713C492DB0A215B1530AF51FCCDD0069F22C8466F1F84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/xxhash-addon/build/Release/addon.node
- Size 136KB
- SHA256 369679f3869d47d8e4cf8aa0c5d6138318633a103377eb651d81358dd4f53d68
- MD5 2dc919a49d72bb287d630e1caa5faa85
- SHA1 e81d86d964f6ddc8b35d64689835cad033e75b3d
- SHA512 7d6f16a8b88039ccdfb4414e7617bef3021ada0852a7252808572a930cce175950fe717d21b17c269eb81706ce8274ee13da9a9527e57a3298ba60f80cf4fbc0
- SSDEEP 3072:XtazTV6GnfTiXVNo+3lL+Q1icFQQ3MmrUbZXde:XtimX/nLOcOQSt
- TLSH
  T1B3D36B47B6A500BBE5B7823CC5B70A46F7B2B81457509FEF43A442A61F133D09E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/xxhash-addon/xxHash/xxhash.h
- Size 247KB
- SHA256 be275e9db21a503c37f24683cdb4908f2370a3e35ab96e02c4ea73dc8e399c43
- MD5 322119a72933bdb526d797d24ecb6a0e
- SHA1 ca369993344c436cf2472d0e63743e87c853ce79
- SHA512 3ddee50fb539f75b13069715dfb07211adb0d9c9039bddccceab8c39760dabd5c57a10272a7c244a6d4f671e271ccb2546e4899f6d0b485e9da5dfdfa5f6c01e
- SSDEEP 3072:z5+4zJkmKLGkGGysa7tG8nOH1vC5N2ExfhDnWWQPwx5zfTtL1WM/TehIoCH2J:1KLm7bIC5NFtp7/TiI1H2J
- TLSH
  T13834D84E39A25D220D8300F7339D13C3A316985BB35195E6344FB6293F0FDA592BAEE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/xxhash-addon/xxhash-addon.js
- Size 187B
- SHA256 0083a2ec614a4fd2749e5349232c91d67c2b339063bedeb7201aa12e3ff28881
- MD5 3a3a1a6a57992e6d48df95588a395a5e
- SHA1 36f402c48df5b770cc6d860c78029ab1f1fe6c8b
- SHA512 70b418f42a409dfe731ffe9b1b233e39dc42d95809c283c39039981db7583c79ab0e702f08033525f0535c99feb8fcff77ed4556ce3cdbfaeee1bef46aa417e9
- TLSH
  T18AC012960CF96726376402D5C65F6623B0D9C0600188DAD48D298365B2CB7604917CE5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32