General
- Target RapidTyping_Setup_5.5.zip
- Size 15.6MB
- Sample260707-gz1xvsbt7v
- SHA256 74390e0071b692a2e1d81bce14e0b92a741e6f21fc2b4ec624769c1a5e3ae45e
Malware Config
Targets
-
- Target RapidTyping_Setup_5.5.exe
- Size 15.7MB
- SHA256 6af518fd596d939a8b0386d0f47076445751bd46e2f986f47fd1a045f0ce2897
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target RapidTyping.chm
- Size 593KB
- SHA256 b50327fbc43c77f208fd25b3eb80c34abd20e25fc8933b8a12a207cb0b5026fd
Score3/10 -
- Target RapidTyping.exe
- Size 2.7MB
- SHA256 57894380248db96acd035594b1b20bd4de71f83cdcb0c4a24641c8a30feababd
Score3/10 -
- Target Resources/Template/Export/HTML/LTR/Example_1.html
- Size 3KB
- SHA256 b8e7373118d73a9f1940de98f9a593ac7f42e18b235ed8c5ecdea8ba7b669d19
Score4/10 -
- Target Resources/Template/Export/HTML/LTR/Template_1.html
- Size 3KB
- SHA256 279a63ca09f684680f493f9a911a0ced1f8240f147e549e190568e0d730bc905
Score4/10 -
- Target Resources/Template/Export/HTML/RTL/Template_1.html
- Size 3KB
- SHA256 1d1adf26e4253826317400627a4a665c39fc09d78ee8d9858a9014a87476eae2
Score4/10 -
- Target Uninstall.exe
- Size 202KB
- SHA256 e15219624658a5152b8f2b0a2abdc4a368ece3b735860918c5caf5690fd1be87
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score3/10 -
- Target fmodex64.dll
- Size 1.4MB
- SHA256 85c9e24be7e2a853614bb6eff0105cf50d8aa9c338f5237198ba732c01d71f37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target icudt49.dll
- Size 17.1MB
- SHA256 bc4aedd89446803680a1b488a78eefc4b52e1189251b9abc0c4f1fc773ef6ef1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target icule49.dll
- Size 196KB
- SHA256 e43bb61dbe858b6a0de845b6f788ea5b9feceefaf6b2c712dc4cb08e4557eab0
Score1/10
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1