Overview

overview

8

Static

static

3

cursorfixe....0.exe

windows10-2004-x64

7

cursorfixe....0.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

cursorfixed1.06.exe

windows10-2004-x64

7

cursorfixed1.06.exe

windows11-ltsc_2024-x64

8

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

ffmpeg.dll

windows11-ltsc_2024-x64

1

libEGL.dll

windows10-2004-x64

1

libEGL.dll

windows11-ltsc_2024-x64

1

libGLESv2.dll

windows10-2004-x64

1

libGLESv2.dll

windows11-ltsc_2024-x64

8

resources/...fi.dll

windows10-2004-x64

3

resources/...fi.dll

windows11-ltsc_2024-x64

3

resources/...fi.dll

windows10-2004-x64

1

resources/...fi.dll

windows11-ltsc_2024-x64

1

resources/...cks.js

windows10-2004-x64

3

resources/...cks.js

windows11-ltsc_2024-x64

3

resources/...ons.js

windows10-2004-x64

3

resources/...ons.js

windows11-ltsc_2024-x64

3

resources/...put.js

windows10-2004-x64

3

resources/...put.js

windows11-ltsc_2024-x64

3

resources/...ion.js

windows10-2004-x64

3

resources/...ion.js

windows11-ltsc_2024-x64

3

resources/...isc.js

windows10-2004-x64

3

resources/...isc.js

windows11-ltsc_2024-x64

3

resources/...put.js

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    cursorfixed1.06 1.0.0.exe
  • Size 73.5MB
  • Sample260706-3tde9saw4p
  • SHA256 507c09cde3617e5f644de2dc121dce6a6cec9d8d6542ff2d770bde157007b4ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target
      cursorfixed1.06 1.0.0.exe
    • Size 73.5MB
    • SHA256 507c09cde3617e5f644de2dc121dce6a6cec9d8d6542ff2d770bde157007b4ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryexecutionspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      LICENSES.chromium.html
    • Size 8.8MB
    • SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral7behavioral8
    • Target
      cursorfixed1.06.exe
    • Size 164.7MB
    • SHA256 392e80a4d25d55b259eb6d8c35562a7fd95b3fa90a8a46536eb577b3d7debfdb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwaredefense_evasiondiscoveryexecutionpersistencespywarestealer

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Enumerates processes with tasklist

      discovery
    behavioral10behavioral9
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      ffmpeg.dll
    • Size 2.8MB
    • SHA256 9d1eb0c6eb12bfa87e74a65c2fde5d61c4c93e21fb0800bbdccb6559527036a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12behavioral13
    • Target
      libEGL.dll
    • Size 477KB
    • SHA256 9cfc3001191e8b3eb9c96ba29e57e5bf9aaab264e83897e47cb968167a8a811b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14behavioral15
    • Target
      libGLESv2.dll
    • Size 7.3MB
    • SHA256 80c2ef6ca6d0ff4877bd0c0bc082ff19c3a5002d53648bcf5f54368560f9a411
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistencespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral16behavioral17
    • Target
      resources/app.asar.unpacked/node_modules/koffi/build/koffi/win32_ia32/koffi.node
    • Size 1002KB
    • SHA256 af700e05e2578e3062917248fd5cb3a2cfdb209e2aeedf157b072534d0e884c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral18behavioral19
    • Target
      resources/app.asar.unpacked/node_modules/koffi/build/koffi/win32_x64/koffi.node
    • Size 1.5MB
    • SHA256 cd9fb878c2e73711e37cf82e60526509a3df361148396dcb3a95b053b582880c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20behavioral21
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/callbacks.md
    • Size 8KB
    • SHA256 29c28636411bede482b63fab512caaa9a813cd42261a5271d71a7ab4f762ace8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral22behavioral23
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/functions.md
    • Size 9KB
    • SHA256 59442e4bdb502bf22e1207afa75e38983b837d7b68f890387f9e30bb53976ba9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral24behavioral25
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/input.md
    • Size 16KB
    • SHA256 be0569a396cb33e70d7f95edfe7a0957669566694c75cf87212c0881e3bf4adf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral26behavioral27
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/migration.md
    • Size 4KB
    • SHA256 3c5ef411cc137e194e3bff13243f7d7c7c71da12e09ce4e103f79ba79906ca90
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral28behavioral29
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/misc.md
    • Size 6KB
    • SHA256 09602031dd666662c6024f35dcc5c4a4e74c31b8a18d4aa7e9999c1937d71640
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral30behavioral31
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/output.md
    • Size 9KB
    • SHA256 b92367ccfdca8da935cfb2351240f5599896df152347d0b835e2f348b1175e4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionspywarestealer
Score
7/10

behavioral2

defense_evasiondiscoveryexecutionspywarestealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
4/10

behavioral9

defense_evasiondiscoveryexecutionspywarestealer
Score
7/10

behavioral10

adwaredefense_evasiondiscoveryexecutionpersistencespywarestealer
Score
8/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

adwarepersistencespyware
Score
8/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10