General
- Target Harbor_0.9.20_x64-setup[1].exe
- Size 266.5MB
- Sample260708-d2dnkaaz5m
- SHA256 1879c7df4283542cbe2bca025f89c472ee7d1f9bd65cfbb7f906869f773eada8
Malware Config
Targets
-
- Target Harbor_0.9.20_x64-setup[1].exe
- Size 266.5MB
- SHA256 1879c7df4283542cbe2bca025f89c472ee7d1f9bd65cfbb7f906869f773eada8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 44a0326fa861ad24afa76fe1d5505fed20b4832cbb87ead5ec60edfec58cbb0b
Score1/10 -
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 830088e49386fe321e0304896bd51566f166cec612299c38aa557bb90d601d33
Score1/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
Score3/10 -
- Target ffmpeg.exe
- Size 96.8MB
- SHA256 228d7a8556258de907fdb55f36850078ebc7680b84ec30d84ea02e99bec1d1eb
Score1/10 -
- Target ffprobe.exe
- Size 96.6MB
- SHA256 0fde260f5abd35c9cafd96f594cc76365a780c1b73a90e35b6a3409ea1db1bf0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target fonts/LICENSE-OFL-NotoSansJP.txt
- Size 4KB
- SHA256 6a73f9541c2de74158c0e7cf6b0a58ef774f5a780bf191f2d7ec9cc53efe2bf2
Score1/10 -
- Target fonts/NotoSansJP-Bold.otf
- Size 4.4MB
- SHA256 1b0edfb500b73a4fa8a4fcaae1bbbd403994e08e73e3e0da37e70d3853f42c5f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target fonts/NotoSansJP-Regular.otf
- Size 4.3MB
- SHA256 dff723ba59d57d136764a04b9b2d03205544f7cd785a711442d6d2d085ac5073
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target harbor.exe
- Size 152.9MB
- SHA256 215df8249c89a02810c0f1c310e5d5023c7cba7e06ee44c89702de4b907f0422
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target libmpv-2.dll
- Size 112.5MB
- SHA256 e9c87d19055bc5a82771b2b48e9fbae047bd5180603f5a1aaae10c90ca690467
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.