General
- Target LTK.Manager_1.11.0_x64-setup.exe
- Size 132.7MB
- Sample260708-ygcwrafx2j
- SHA256 bc2158231da58244bfa10d2a4bf7a3c11400af37974170ff7345d9d74cc6739d
Malware Config
Targets
-
- Target LTK.Manager_1.11.0_x64-setup.exe
- Size 132.7MB
- SHA256 bc2158231da58244bfa10d2a4bf7a3c11400af37974170ff7345d9d74cc6739d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/app-64.7z
- Size 131.7MB
- SHA256 04770791529e024c6cb8549d0716fe8225b377a74ac6ab67df8465ef448fd74b
Score1/10 -
- Target cslol-manager.exe
- Size 172.1MB
- SHA256 8963959b064fde7fe3ed002426112f393c028df9232d08c3e6914bd88db1d035
Score7/10-
Loads dropped DLL
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 604de5c5b2d25c731e01d0c08b8cb21c872a886ac1f6d3e3c13e8b29f84a0f93
Score1/10 -
- Target libEGL.dll
- Size 470KB
- SHA256 0152aca7a9865b7cae2c437d85d6c771a16afc9da2929ddb49eff9cc70b42f62
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 c5f86befae432c8d0b8942e7cf24a4b5c307e7fd421eae248946e81381cd62f3
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target resources/java/a850a32ff66e.jar
- Size 28.7MB
- SHA256 f4ff1cde5322ff24bba3724f256971a9aabf8dbc72e81ab12c8993904a45ec79
Score1/10 -
- Target resources/java/jre/bin/java.dll
- Size 119KB
- SHA256 97a44d1648fad516c28304ea249b9bf4cf49c3be3b46b9df37b7f734feeac352
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/java/jre/bin/java.exe
- Size 49KB
- SHA256 bd3d87dfb44651a1c61c995e08ca4fcadb458437a373d46941381f9aeff9d6a0
Score1/10 -
- Target resources/java/jre/bin/javajpeg.dll
- Size 178KB
- SHA256 d66f4897581a12613b87831111908d22702daf8c3fa1911c18b664f527cbf108
Score1/10 -
- Target resources/java/jre/bin/javaw.exe
- Size 49KB
- SHA256 b2a51f8b8d2204fca946108c14481d09d4b2d0335ad282be7296ae2f4e4c2ef6
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2