General
- Target launcher_Setup.exe
- Size 91.2MB
- Sample260712-ch1tbaes5x
- SHA256 09b654ea96b53255bdeffe2a8d3b602c4358e7419158969eb00e397d7257a655
Malware Config
Targets
-
- Target launcher_Setup.exe
- Size 91.2MB
- SHA256 09b654ea96b53255bdeffe2a8d3b602c4358e7419158969eb00e397d7257a655
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 9.0MB
- SHA256 4bf4dd1a05ecba975c90d85117dea74b0e94114f882bb26a7e7d1029afe8fda8
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 34e3ef3a3ed2df4e0a4a813bbb37346b01e48df1a214dbd0dc1eb90d3e81e258
Score1/10 -
- Target launcher.exe
- Size 178.0MB
- SHA256 90f27288a06b36f8e9b28f179bbaf9793262012d89d142a89f74a4bb36eba71d
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target libEGL.dll
- Size 473KB
- SHA256 6e45cab21be31b359ad969d777731943791917bd4bf309178e4965047f321a94
Score1/10 -
- Target libGLESv2.dll
- Size 8.0MB
- SHA256 90a1a55d9c62ce328c803b25e6618ebeee16ef1167d269b69e4adee85ef0c0fb
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.6MB
- SHA256 7bbe7704e4b68ca6c2c54ddc80df52413b3d14500aefbf6ef6b05316e3ca42ef
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
Score7/10-
Executes dropped EXE
-
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Unix Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1System Checks
1