General
- Target fabricinstaller Setup 1.0.0.exe
- Size 124.8MB
- Sample260705-pxekvaf19j
- SHA256 8bfd5d29ca71d646fb0df8329df4fda84b8b06813e8932c713fb4112b98102fe
Malware Config
Targets
-
- Target fabricinstaller Setup 1.0.0.exe
- Size 124.8MB
- SHA256 8bfd5d29ca71d646fb0df8329df4fda84b8b06813e8932c713fb4112b98102fe
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 124.3MB
- SHA256 a2380fcc66df12617dd098fc340e898b503d7e1a9fbf29e93583eb3186e12e96
Score1/10 -
- Target resources/j/bin/msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/j/bin/net.dll
- Size 96KB
- SHA256 80c85f578afa95e52ad502b05c669030a8f4245e3c289534f1d81ef6bdf97127
Score1/10 -
- Target resources/j/bin/nio.dll
- Size 78KB
- SHA256 aef35f2aa1817fa845f2eddc678e671424fea538fff5bde207789ad9ec8c5faa
Score1/10 -
- Target resources/j/bin/prefs.dll
- Size 25KB
- SHA256 ed16fd5dd63d0d35a5b3b8a0decf97232d8fca159ce7625989419145b942745e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/j/bin/rmi.dll
- Size 20KB
- SHA256 2f69aba2860f53d9bcca46106b7ea37751d99dfefe8c466ad66887cfd8611bfd
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/j/bin/rmiregistry.exe
- Size 24KB
- SHA256 74b017bfc1c00124159b37e07cc20da39d37c7e6984dd6f37f342f5e4e6f09cd
Score1/10 -
- Target resources/j/bin/server/jvm.dll
- Size 12.1MB
- SHA256 89c64a12328b82bbacdeafd0cbcabf175aeed0581f99fe0f737ddbd962c25fd4
Score1/10 -
- Target resources/j/bin/splashscreen.dll
- Size 211KB
- SHA256 546e2cb59d6c920dee0ee045c7cd5d8a53ba3f9e77277456434a9df1b270b991
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/j/bin/sspi_bridge.dll
- Size 44KB
- SHA256 1a24eab17f3be94f770482b4838b6ca8a6513fed3c4575416d96717704336115
Score1/10 -
- Target resources/j/bin/sunmscapi.dll
- Size 46KB
- SHA256 aa39dd045cb3405bf415c127110f1bc8f6776e0495a70f5c23579108750d132b
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1