Overview

overview

8

Static

static

3

ABDownload...64.exe

windows11-21h2-x64

8

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

ABDownloadManager.exe

windows11-21h2-x64

7

app/Compos...2d.jar

windows11-21h2-x64

1

app/aboutl...a7.jar

windows11-21h2-x64

1

app/animat...fc.jar

windows11-21h2-x64

1

app/animat...f8.jar

windows11-21h2-x64

1

app/annota...6a.jar

windows11-21h2-x64

1

app/annota...60.jar

windows11-21h2-x64

1

app/app-2e...ad.jar

windows11-21h2-x64

1

app/app-de...1c.jar

windows11-21h2-x64

1

app/app-ut...9f.jar

windows11-21h2-x64

1

app/arrow-...f0.jar

windows11-21h2-x64

1

app/arrow-...2d.jar

windows11-21h2-x64

1

app/arrow-...e4.jar

windows11-21h2-x64

1

app/arrow-...1f.jar

windows11-21h2-x64

1

app/arrow-...ba.jar

windows11-21h2-x64

1

app/atomic...87.jar

windows11-21h2-x64

1

app/auto-s...36.jar

windows11-21h2-x64

1

app/auto-s...aa.jar

windows11-21h2-x64

1

app/back-h...1a.jar

windows11-21h2-x64

1

app/collec...37.jar

windows11-21h2-x64

1

app/common...bb.jar

windows11-21h2-x64

1

app/common...65.jar

windows11-21h2-x64

1

app/common...c5.jar

windows11-21h2-x64

1

app/common...24.jar

windows11-21h2-x64

1

app/common...9a.jar

windows11-21h2-x64

1

app/compos...f3.jar

windows11-21h2-x64

1

app/config...cb.jar

windows11-21h2-x64

1

app/contra...99.jar

windows11-21h2-x64

1

app/core-c...6d.jar

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    ABDownloadManager_1.9.2_windows_x64.exe
  • Size 66.9MB
  • Sample260712-d5sa5aew9w
  • SHA256 d4006e160854c5ca0b78a1d27c95f5d27c77547de819d543fecef9d5abd64c18
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Targets

    • Target
      ABDownloadManager_1.9.2_windows_x64.exe
    • Size 66.9MB
    • SHA256 d4006e160854c5ca0b78a1d27c95f5d27c77547de819d543fecef9d5abd64c18
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwarespywaretrojan

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      ABDownloadManager.exe
    • Size 541KB
    • SHA256 61ad36f768a7668f54262a6ed52645bcaeac8f295916a1d6d94109577e2af9a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral4
    • Target
      app/ComposeNativeTray-jvm-a7f8d1fca19e8e18ddd74fe3ba639a2d.jar
    • Size 685KB
    • SHA256 17c075d9fb0b37e6be909a0d27d6c7ae1c26f8ac44154cce2f741b4c8b1b7732
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      app/aboutlibraries-core-jvm-225ee93bf4d2373655a49ac991ca0a7.jar
    • Size 56KB
    • SHA256 326cd92f7e1449f8e5ff6c17e6b7d81f5329099efd44004562cc7a98ce0e7ab3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      app/animation-core-desktop-1.11.1-3ec8687bba1c875f4630e7c99d49defc.jar
    • Size 380KB
    • SHA256 1b3af8d20627b01101d827f72e26dbadccc8d212c0ffc0c02ff2a6fc967a6ca8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      app/animation-desktop-1.11.1-3b1636eba8fac16d053e567d9b91df8.jar
    • Size 403KB
    • SHA256 bb41c6c550a471c68c51185c3bb0458482a4e803ee074bf215adc8832e2007e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      app/annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
    • Size 59KB
    • SHA256 1e343917ebf27ba96fe4dc52b1cad7fd32b738fbc6355bb6cd5b3b305d7212d0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      app/annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
    • Size 28KB
    • SHA256 7b0f19724082cbfcbc66e5abea2b9bc92cf08a1ea11e191933ed43801eb3cd05
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      app/app-2e695b23323b612d93a738780ad.jar
    • Size 2.4MB
    • SHA256 336ed5064604792b5e54cd427889c4b2fca2aed56d39d6cb1d6b8f6799113be5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      app/app-desktop-6db5fe5c71c24092ca11cfb686b5f81c.jar
    • Size 2.4MB
    • SHA256 d5d7452294680860f9a9b991c5d5d8c319ed5b2e50d84fe2cf653dbcfc76238f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      app/app-utils-2ad72a13e8942dd5bbb43ba6d2def9f.jar
    • Size 191KB
    • SHA256 0f4f1eb5befa480a76ad5c91885d036e7a76776df9b2f1a3b4743f12920a4acb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      app/arrow-annotations-jvm-2.2.3-857c7f7cfc297b186c96f34ce36f1f0.jar
    • Size 3KB
    • SHA256 5db812b43458d694a2d676491bdcd6eca04a44f3ae6336db3c71fce67be8e1bc
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral14
    • Target
      app/arrow-atomic-jvm-2.2.3-fcdd2aa54ac9ac7a64d0e0f2abce762d.jar
    • Size 14KB
    • SHA256 9605a129250898db4a8e1011fb6faab1f1ade1dea290dae467eae2e60289f755
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15
    • Target
      app/arrow-core-jvm-2.2.3-51f4cb361b521378e540d1a07c2ea0e4.jar
    • Size 729KB
    • SHA256 a2d334ad01cf22cc534ff254788d1877e4df1564fd2b1101736a6c0e8d9a7a47
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      app/arrow-exception-utils-jvm-2.2.3-83e0edc414289b8830c47d193229a81f.jar
    • Size 3KB
    • SHA256 1a6604e1dbe1af48a743ed1923f4754b389933c9ef3ec8aad6b7543418196796
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral17
    • Target
      app/arrow-optics-jvm-2.2.3-bb9a6a1e7afe01f3e2c5772f0ba9ba.jar
    • Size 259KB
    • SHA256 d3a99ab61599c0e87147aec2525deb608bed4404a12392bf69afaacaf030a9b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      app/atomicfu-jvm-0.28.0-70921245a0aed3c3e3d17c34ca3dbd87.jar
    • Size 47KB
    • SHA256 39576ec46b83412ff7a2909d24cccbba90400e91f9aa67b250309bc0872ecf52
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      app/auto-service-annotations-1.1.1-418feb19f713c38641702c9b933436.jar
    • Size 3KB
    • SHA256 16a76dd00a2650568447f5d6e3a9e2c809d9a42367d56b45215cfb89731f4d24
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral20
    • Target
      app/auto-start-desktop-81361cb42365afff1ad3b8f2afcec1aa.jar
    • Size 17KB
    • SHA256 9d86afc5c143ebb6964dae5f2653886593b56cfaaf2f3caf33d72c2f25011eb9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      app/back-handler-jvm-2.5.0-49963c2576ada1f4bc836dc94ba321a.jar
    • Size 21KB
    • SHA256 14f14c52086d1c02296c5f07eae3122103226baa922f0cb2f358e0dbfe42d1f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22
    • Target
      app/collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar
    • Size 857KB
    • SHA256 70b35924e4babcdffa37d0e575ee039c56a2d97123342624c48b603233704341
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      app/commons-configuration2-2.15.1-9482ce10567d28f4d259397218bd2bb.jar
    • Size 672KB
    • SHA256 61ba5eaab8a17087042fe3d6811573bb85ccbdd6bd9d21ad464e6e20559dd1e8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      app/commons-io-2.22.0-f91d54bd47c42456b4a5ae62eed85565.jar
    • Size 594KB
    • SHA256 2b9a7b1f726fb86216dbd2c8321eabe0221dbd5b1be81c18e1cb53811b104758
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      app/commons-lang3-3.20.0-4b29562ded527aa074e1d44f8646dac5.jar
    • Size 697KB
    • SHA256 69e5c9fa35da7a51a5fd2099dfe56a2d8d32cf233e2f6d770e796146440263f4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      app/commons-logging-1.3.6-feccbe8971fed954aad6528fe3ef24.jar
    • Size 72KB
    • SHA256 f8ead8943401081dea0aa824b5b1ba40a0e4ed297a572a0f02258150a0b62357
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      app/commons-text-1.15.0-756b7c5438d89ac311d811c1a6d19a.jar
    • Size 258KB
    • SHA256 58d2da30f058512a1e7f914e39241deca4dff5c27a085b4ed2faa9e7208067f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      app/compose-utils-desktop-199b711205e4bf5e4d9b02ae75ccf3.jar
    • Size 92KB
    • SHA256 7427f7f00839c5e8ba6bd747c1baf22e622e0b403cfb9aeca002f92b3429c1c5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29
    • Target
      app/config-8c9bf9b0b998c4c8d55f210f495bcb.jar
    • Size 56KB
    • SHA256 5688ed340d4d7d4480e16a313e33e21d40fed0472e32165338f0e9137a08ab95
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30
    • Target
      app/contracts-desktop-64df2aba6e5f9612fef4d7917888c99.jar
    • Size 8KB
    • SHA256 45bf3ada415100ae078ad50755f55c4123451ea3b1d1ef2c4e36bddc2a98a213
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31
    • Target
      app/core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar
    • Size 11KB
    • SHA256 65308a06b1c00ee186cb9e19321383f043b993813f1522c47f4a3e3303bdba41
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

3
T1553

Install Root Certificate

2
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwarespywaretrojan
Score
8/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

persistence
Score
7/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10