General
- Target betterjepp-1.9.2-setup.exe
- Size 116.4MB
- Sample260707-n5f8zag18w
- SHA256 adfc4a9b1b9a7bd96444eb4c16f508bde3d20fac03b6bf1d22c2fb1142b2e4b6
Malware Config
Targets
-
- Target betterjepp-1.9.2-setup.exe
- Size 116.4MB
- SHA256 adfc4a9b1b9a7bd96444eb4c16f508bde3d20fac03b6bf1d22c2fb1142b2e4b6
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 115.8MB
- SHA256 f78d5ac1beacf8ea94457671dc15a9a145e7fa09c658251365326a05b3d4054d
Score1/10 -
- Target resources.pak
- Size 6.0MB
- SHA256 40af4117b0bd35da141aa599255b879013bfda5968401feccb5c43cb372cdae6
Score3/10 -
- Target resources/app-update.yml
- Size 118B
- SHA256 c6c632b5961b8442d0c8d1749ce53d99497402dc3a773a28eadf572a4c988151
Score3/10 -
- Target resources/app.asar
- Size 93.6MB
- SHA256 4ff24ce5c05fac44178b02f555c0057553ae7cd814c284b1ff832a3a4828853e
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/@napi-rs/canvas-win32-x64-msvc/icudtl.dat
- Size 10.0MB
- SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/@napi-rs/canvas-win32-x64-msvc/package.json
- Size 638B
- SHA256 166a840d57c0770990e71562f13277327248eb56b04a2b7dcd2dfc7582091bd3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/@napi-rs/canvas-win32-x64-msvc/skia.win32-x64-msvc.node
- Size 27.0MB
- SHA256 460e1f8698aa39e20db46cf84c2381382aec80a00a305f92aa175a92dd9049ff
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/@tailwindcss/oxide-win32-x64-msvc/LICENSE
- Size 1KB
- SHA256 60e0b68c0f35c078eef3a5d29419d0b03ff84ec1df9c3f9d6e39a519a5ae7985
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/@tailwindcss/oxide-win32-x64-msvc/package.json
- Size 528B
- SHA256 bbae0af3962f3a1a8687c257d184bba2e4d5d9b4416f72dce13cbb36f9e20107
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/@tailwindcss/oxide-win32-x64-msvc/tailwindcss-oxide.win32-x64-msvc.node
- Size 3.1MB
- SHA256 d06c1806d134eabfd9091ee828b849c69ff78c823bf4dc7c7330868e704ef56f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/lightningcss-win32-x64-msvc/LICENSE
- Size 15KB
- SHA256 5eba353fe5076ac3432177f8ab1cf75e3afcd0584251e37c3bfead5f447d040e
Score1/10