Overview

overview

7

Static

static

3

cwtch-inst....2.exe

windows10-2004-x64

7

cwtch-inst....2.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

Tor/Tor/tor.exe

windows10-2004-x64

3

Tor/Tor/tor.exe

windows11-ltsc_2024-x64

3

data/flutt...up.svg

windows10-2004-x64

3

data/flutt...up.svg

windows11-ltsc_2024-x64

4

data/flutt...FF.svg

windows10-2004-x64

3

data/flutt...FF.svg

windows11-ltsc_2024-x64

4

data/flutt...on.svg

windows10-2004-x64

3

data/flutt...on.svg

windows11-ltsc_2024-x64

4

data/flutt...or.svg

windows10-2004-x64

3

data/flutt...or.svg

windows11-ltsc_2024-x64

4

data/flutt...ed.svg

windows10-2004-x64

3

data/flutt...ed.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

data/flutt...px.svg

windows10-2004-x64

3

data/flutt...px.svg

windows11-ltsc_2024-x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    cwtch-installer-v1.16.2.exe
  • Size 36.9MB
  • Sample260706-ybbfqscv4w
  • SHA256 d86204f1b4f43d1c108dd152547a1437550eb3f3bf30d2add7bbc29c7b66f79a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Targets

    • Target
      cwtch-installer-v1.16.2.exe
    • Size 36.9MB
    • SHA256 d86204f1b4f43d1c108dd152547a1437550eb3f3bf30d2add7bbc29c7b66f79a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      Tor/Tor/tor.exe
    • Size 8.6MB
    • SHA256 fd75f110fb9970c5dd682beb1bc94111811eed50fdd056f04a722274510795a7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral7behavioral8
    • Target
      data/flutter_assets/assets/core/Tor_Booting_up.svg
    • Size 5KB
    • SHA256 8c925f7857a66410b11971fde904894a3f12b59554ae1a887e2e491e8db2751b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral10behavioral9
    • Target
      data/flutter_assets/assets/core/Tor_OFF.svg
    • Size 5KB
    • SHA256 6678254c58896bfb92fdc729e65f4671353a8246bf53f44dee538378d49ae073
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral11behavioral12
    • Target
      data/flutter_assets/assets/core/Tor_icon.svg
    • Size 6KB
    • SHA256 306a1dd9abeaa289d71222f8cd215159d012ff11d2b9cf380d00647e93c62c9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral13behavioral14
    • Target
      data/flutter_assets/assets/core/Tor_icon_error.svg
    • Size 7KB
    • SHA256 6b62c428e1f7e518f06bd7cef66022f9e3551d0a1d427edecbc3bd2ee2ea7dcd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral15behavioral16
    • Target
      data/flutter_assets/assets/core/account_blocked.svg
    • Size 1KB
    • SHA256 05f92abb4e61cc5e1244e04937786a6ec7136f22bcef4626b85cf522978ec531
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral17behavioral18
    • Target
      data/flutter_assets/assets/core/account_circle-24px.svg
    • Size 367B
    • SHA256 0aaa79838b5ce6f35c0191868cd979d39edcc57d050b0cf86ceea3a5ae1a5acd
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral19behavioral20
    • Target
      data/flutter_assets/assets/core/chevron_left-24px.svg
    • Size 195B
    • SHA256 a13ea3441e8c0114d7106dd015305fdc80c472f696dd9922a2c6a5f8790aaf9a
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral21behavioral22
    • Target
      data/flutter_assets/assets/core/delete-24px.svg
    • Size 189B
    • SHA256 b39fb4dcdc27694a6c2bcef63d547b83290bec896fd080d03ecf8f7415208853
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral23behavioral24
    • Target
      data/flutter_assets/assets/core/drag_indicator-24px.svg
    • Size 431B
    • SHA256 5737806d54eae03d5cc02f2dbf7753ecb800fb8fba6ce93e5b1d1c3a9ed5b87b
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral25behavioral26
    • Target
      data/flutter_assets/assets/core/favorite-24px.svg
    • Size 314B
    • SHA256 74349ea95cb8f998310bc784cea134e0acb5c9774ed1cdf9bbcd7218304e382e
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral27behavioral28
    • Target
      data/flutter_assets/assets/core/group_settings-24px.svg
    • Size 1KB
    • SHA256 24a8e976b43db337ddcde86245b05dd56cd9e6d6398241d7c74cc90eb5670635
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral29behavioral30
    • Target
      data/flutter_assets/assets/core/info-24px.svg
    • Size 236B
    • SHA256 6b67bfd0c91c55b9baf5f428afffd3388d3f42ed5ebe7f8df3d0474135204348
    • MD5 SHA1 SHA512 TLSH
    Score
    4/10
    adwarediscoveryspyware
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

adwarediscoveryspyware
Score
3/10

behavioral10

adwarediscoveryspyware
Score
4/10

behavioral11

adwarediscoveryspyware
Score
3/10

behavioral12

adwarediscoveryspyware
Score
4/10

behavioral13

adwarediscoveryspyware
Score
3/10

behavioral14

adwarediscoveryspyware
Score
4/10

behavioral15

adwarediscoveryspyware
Score
3/10

behavioral16

adwarediscoveryspyware
Score
4/10

behavioral17

adwarediscoveryspyware
Score
3/10

behavioral18

adwarediscoveryspyware
Score
4/10

behavioral19

adwarediscoveryspyware
Score
3/10

behavioral20

adwarediscoveryspyware
Score
4/10

behavioral21

adwarediscoveryspyware
Score
3/10

behavioral22

adwarediscoveryspyware
Score
4/10

behavioral23

adwarediscoveryspyware
Score
3/10

behavioral24

adwarediscoveryspyware
Score
4/10

behavioral25

adwarediscoveryspyware
Score
3/10

behavioral26

adwarediscoveryspyware
Score
4/10

behavioral27

adwarediscoveryspyware
Score
3/10

behavioral28

adwarediscoveryspyware
Score
4/10

behavioral29

adwarediscoveryspyware
Score
3/10

behavioral30

adwarediscoveryspyware
Score
4/10

behavioral31

adwarediscoveryspyware
Score
3/10

behavioral32

adwarediscoveryspyware
Score
4/10