General
- Target Leonardo 0.17.70 Multilingual Beta [FileCR].zip
- Size 7.8MB
- Sample260707-tbbdhsgy91
- SHA256 e3bc323582a1de50449cbbfd1e6d602e436c16cf44587d6b86c13945376db7f6
Malware Config
Targets
-
- Target Leonardo 0.17.70 Multilingual Beta [FileCR].zip
- Size 7.8MB
- SHA256 e3bc323582a1de50449cbbfd1e6d602e436c16cf44587d6b86c13945376db7f6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target Leonardo 0.17.70 Multilingual Beta/Readme.txt
- Size 485B
- SHA256 b43538fe7a602e13c82af920d953292dc2b034db5e1a655f3db924b3ff582cb4
Score1/10 -
- Target Leonardo 0.17.70 Multilingual Beta/leonardo.0.17.70.winstall.exe
- Size 7.4MB
- SHA256 8d9dbf320aee83c537a32d2fd55567a76eb639aa30ec40c422a28c65f52025f2
Score4/10 -
- Target $PLUGINSDIR/ApplicationID.dll
- Size 198KB
- SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
Score3/10 -
- Target Uninstall.exe.nsis
- Size 16KB
- SHA256 327b0260906ef76f93369e21062d996da87bdedc057e9aa5d4100fc6b2289c58
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target leonardo.0.17.70.win64.exe
- Size 9.4MB
- SHA256 8df6fc289e3d490c2be013e69b13b49e4e691465b0400584cff6bd6ae37fd0eb
Score1/10 -
- Target leonardo.0.17.70.win64arm.exe
- Size 9.2MB
- SHA256 84c9c6ba6bd5434040d098d504d36cf01a58028e6fc9aa4fdfe6d5df084964cd
Score1/10 -
- Target run_latest_leonardo.exe
- Size 655KB
- SHA256 e0f502e5026e2cb408c38bf7feca0d3f990bc9db2a9035206a5a31086270b92c
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Leonardo 0.17.70 Multilingual Beta/password.txt
- Size 13B
- SHA256 4d9644b189d4864e6b8ee89210d3aebd3153653c29b574ac7ae5d32351166653
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Leonardo 0.17.70 Multilingual Beta/zmco-patch.exe
- Size 1.5MB
- SHA256 c93ebff2895292679c5da2e1e58c47fb5821e5e8b57b7bda2a4678514e25d616
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
- Target Leonardo 0.17.70 Multilingual Beta/zmco.nfo
- Size 4KB
- SHA256 4fa23ba82fd7fb503ac55854fb88494e4e8d6f166d4577d6eabde7c9a698e8f4
Score1/10