4657f15975998273e9eeb3a440d7437daffb933ace8874973b823063d5cca5ef

Sharing

Copy URL Twitter E-mail

General

Target
geode-installer-v5.2.0-win.exe
Size 44.8MB
Sample260703-ya4e5abx9j
SHA256 4657f15975998273e9eeb3a440d7437daffb933ace8874973b823063d5cca5ef
MD5 a9990e2adc0390de69ee91c12e463e1e
SHA1 d3542223b0a51d43897c0028acbd383eeb3148dd
SHA512 0920d051d52656c9b75e8c8f07dac9f4d6d143430f9409afd6dcf2f9dfb0c681094d323c1ab3574e74ca8b29125d64c3f2404c10d014df9f635846f4e91f2457
SSDEEP 786432:/6wDuFYibOEbt+Q4IkSXVynsVkFPrgZ+TplQCfVqLuv5cfRfKEXuGln7ZAOGZ:/6wDdN6kPIkGEhprltILrf7+Gln93O
TLSH
T159A733AD12F2D9B2F60173F98C84FAD93C065BBE284513769705B15C1CE08AFEB99712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  geode-installer-v5.2.0-win.exe
- Size 44.8MB
- SHA256 4657f15975998273e9eeb3a440d7437daffb933ace8874973b823063d5cca5ef
- MD5 a9990e2adc0390de69ee91c12e463e1e
- SHA1 d3542223b0a51d43897c0028acbd383eeb3148dd
- SHA512 0920d051d52656c9b75e8c8f07dac9f4d6d143430f9409afd6dcf2f9dfb0c681094d323c1ab3574e74ca8b29125d64c3f2404c10d014df9f635846f4e91f2457
- SSDEEP 786432:/6wDuFYibOEbt+Q4IkSXVynsVkFPrgZ+TplQCfVqLuv5cfRfKEXuGln7ZAOGZ:/6wDdN6kPIkGEhprltILrf7+Gln93O
- TLSH
  T159A733AD12F2D9B2F60173F98C84FAD93C065BBE284513769705B15C1CE08AFEB99712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 8KB
- SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
- MD5 313661ec12ed5ce1fd0b3292bf02cb69
- SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
- SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
- SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
- TLSH
  T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Geode.dll
- Size 15.2MB
- SHA256 d9bd34bcef6ae932ab3e9fada549e038bbef2992aeddfd40df75b93765df34b6
- MD5 d6962492d96594fca65848eac2aee01f
- SHA1 f47f8f9d66643dfc75ddaace30f089accfaa0d9c
- SHA512 7573bee1a021601542de46c2b0686082801ae75db0f312b9a07c37044b39bb569dec927630d3b7550359c7fe24da03d01572d77554fdfba0b1d7e6fb0ae45221
- SSDEEP 98304:Qamt5jxbEBpuABItyMp0bsOSrjvDqAb+Jw+05mjjuIJ:th80bQDH+0EjjH
- TLSH
  T11DF64B07F66A20E9D4BAC178438B6223BA7078980B34AFDB465155762F32BF47E3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  GeodeUninstaller.exe
- Size 160KB
- SHA256 0064ab87f88640f6b8106309981a21355fe8d6e96d73f24e61dcd8e1a34bc605
- MD5 3f1d65e69f63aa687f2394f9b107c22d
- SHA1 56c4fd0a7a5adb9c098b5618c3910dfa673f114e
- SHA512 2879c40a214dc563623a8ba31701b7945fbe5e40769fb2e3872c76b18f642e2f0a75a8a7322000a028cfb248add95cebb0af3a518919ba8372c4c19427453c58
- SSDEEP 3072:Qrv+LsMjvFsOTb98xQT+5U5qwqh0bpm8aM3hSrwlwGBF:UWLsKB0IqhnM3hSrwuY
- TLSH
  T19AF38D1CBB758FF6D83588315697FAAB4F21BC708959960BEB111B33DC33555FA0A201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 8KB
- SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
- MD5 313661ec12ed5ce1fd0b3292bf02cb69
- SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
- SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
- SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
- TLSH
  T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  GeodeUpdater.exe
- Size 65KB
- SHA256 0abbf419cb585fcba29b45593dc49a341ed7aaecba235a11b55a7350fd2dc867
- MD5 d77c45733bf2a25796c2379414376e6e
- SHA1 62d6df50915a601a3ba766b0324b34f4a2ea96aa
- SHA512 d50614eb4236fc33500adc93463b18b6f3c4e227a5bdcf8ad69c2413f797d1f02da66c19166507509299a1997950b82e02af922c6262bd8bceb4a407c5d2b86c
- SSDEEP 768:nm9M/devM95NB16SBMvsurOhJQPePny4mZriP4YdaUfvtujZP1vgMKbvzQnG0:SM/dsGsSBMk/SmPy4m1uZNuHjKB0
- TLSH
  T1E863F7057A0698BDD4CAC4B8838709962DA670CB1F32B8DF57C1933E2E746F92F35598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  VC_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH
  T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  XInput1_4.dll
- Size 42KB
- SHA256 c7ad24997952338f47b92d80a6d626475d8faefc74c6c3cec3cdd3ce15ed5842
- MD5 e8c813fb55b59f87d28e51d2f8763267
- SHA1 5aaa4ffd6f3d420cde2e4f43d1c6137a1f642d92
- SHA512 772eacc8e470379a069eaff02339978d6bfb96356d14cd413b089efb1203d46b2473c4e3e904c838cae397283183215ea1e8287d058dfb1e1a55f9b161f410a5
- SSDEEP 768:Hg045t1dD+Bzz7MCv0n+3DBmGhVfcxjnGeqc9a4wwxidU/Qk3FSz+:8PD+Fn0MDBBKNGeqwFc+
- TLSH
  T14B1319057B4944BCC986C4B886474D8A5962B0CE1F32B6EF9381933D2E787F46F39B94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24