General
- Target Vrmod_Setup.rar
- Size 89.7MB
- Sample260715-pxmapafz2y
- SHA256 7095674e2ddc1bd5f16643ff244fb6e6e42e8497d049155238ad13f2c479dd76
Malware Config
Targets
-
- Target Vrmod_Setup.exe
- Size 89.8MB
- SHA256 306878321ebdaaacac9187997599b5c8796b596ef98ba8bd9dff7d10cc86249c
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 9.0MB
- SHA256 96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
Score3/10 -
- Target Vrmod.exe
- Size 172.5MB
- SHA256 89a0e299c5cae41a09729932a75c393b5bb6400a20907fca349e8f487312262f
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 16261687febd0d707c7b90eeb802b3befdec9b20c4fbd29068540c2b94c81de6
Score1/10 -
- Target libEGL.dll
- Size 470KB
- SHA256 18cca9a1952e2699a955690b8a870e614c28321a4e032392f8526677b5712f98
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 ce43b08039628c9969345fdf0861f7633faa9a00356173e6c170dc437353a2b3
Score1/10 -
- Target resources/app.asar.unpacked/index.jsc
- Size 3.2MB
- SHA256 16d36582d66e4838791230d167de8e8fb3e590d47bd3bc383094e351790725a9
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.6MB
- SHA256 cd436f5af1781f2c234a1259ed4ae30a9e7022a51eb29b74c8093a29a06e0ae3
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
Score7/10-
Executes dropped EXE
-
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
3Unix Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1System Checks
1