General
- Target win-hayase-6.4.79-installer.exe
- Size 90.4MB
- Sample260709-sp67nsdw7w
- SHA256 c397ca6b06b164f1d8f59c3a70d5a115261c7ec9cae6833c2eb677ecdfe238c9
Malware Config
Targets
-
- Target win-hayase-6.4.79-installer.exe
- Size 90.4MB
- SHA256 c397ca6b06b164f1d8f59c3a70d5a115261c7ec9cae6833c2eb677ecdfe238c9
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target Hayase.exe
- Size 216.0MB
- SHA256 d5c276d5bb9cea689bc6d36e8f2fd8cb4b8a6cffba6441635d9acb0788ad3068
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 59c828f9209c22b4ba73b85e419de4e405e068538959d36cfa2937def6d93954
Score1/10 -
- Target dxcompiler.dll
- Size 24.5MB
- SHA256 27a4f0c9bcd5b44ed14eb38b2f1ddb8e1212e9c6189f483949fdf3174e3d69a3
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 7edfb946af324fc5534ace1b7d894342d65518ac07ca25d9ac3f2368415ee47f
Score1/10 -
- Target ffmpeg.dll
- Size 4.4MB
- SHA256 c41816ab69964c75b508dc6a6441f49674cce6ed2914c56978e1448de2f7bfaf
Score1/10 -
- Target libEGL.dll
- Size 498KB
- SHA256 bc24116dbb8dfff201ad91672cf8a61a4621b86f983d428e1b199ad654af2359
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 2a2f39149c9cc69d6a58d73fb3b873d3a9087abf767e4c59adf54aca5993cd25
Score1/10 -
- Target resources/app.asar.unpacked/out/main/native-assets/0-paymoapp-electron-shutdown-handler-PaymoWinShutdownHandler.node
- Size 114KB
- SHA256 77b49b81d242500f9285d3dc7a11dafaa6b2a8885eba04561ffef81509067a26
Score1/10 -
- Target resources/app.asar.unpacked/out/main/native-modules/fs-native-extensions/prebuilds/win32-x64/fs-native-extensions.node
- Size 132KB
- SHA256 b35e34c0ad43e7da95079791be24670518c3ecba6584848c750c2660eb03cf5a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/out/main/native-modules/thaunknown-yencode/prebuilds/win32-x64/thaunknown__yencode.node
- Size 199KB
- SHA256 38160376f63e94543c618305559fe9d779398fdc6f901bf5e78b3a546d505ebd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/out/main/native-modules/utp-native/prebuilds/win32-x64/node.napi.node
- Size 644KB
- SHA256 172bcb54e696157570d17cda2420df3da7c02c350f814ca0e0a1717394c8a778
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/default_app.asar
- Size 108KB
- SHA256 06d4a28be095a80eff94dbd18edcfac5b5805e1b5538e0fb7cee7c7ae81db76a
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.4MB
- SHA256 49bd62e01e750fa5719b28718607dbe459d707eb4027da1b9a61a0aeb8f87ae6
Score1/10 -
- Target vulkan-1.dll
- Size 934KB
- SHA256 aed48e6ac540cdea62b094c8660425c3648b03bb9949b0f0dc0f5558d50ae8ad
Score1/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
Score3/10