1663a66cdd6f56c056de09ca2b601e5c767ac5b08725109cf1c5f8068b89e540

Sharing

Copy URL Twitter E-mail

General

Target
GDLauncher__2.0.34__win__x64.exe
Size 160.3MB
Sample260715-t587msgy2n
SHA256 1663a66cdd6f56c056de09ca2b601e5c767ac5b08725109cf1c5f8068b89e540
MD5 14e9c75871c168514913e191ce4b2235
SHA1 a575884e523bb017818a557f64f586fbc3c32261
SHA512 0456dcbc1ba3b38f09b6bd506a2d11f97ce954644bcc6958abd74dc0e70a26c8d1e7b9b847218d3220e5fa771b942d370b3bf1f4705058699dbdc7beb9f9ba21
SSDEEP 3145728:z/qf2VRO5IJTknhaCK6T0dPWhFXn3ULBIrVDKB6N8p9673zw43aaCcD5XcZqGD:ef2VRunXT0lWzHUNIrV2yX3zw4dRDeZn
TLSH
T14D8833E063209F5BCEFACAB1ED83BAB15B946E0726C0D0014F97FC85D9D5998E84C51B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  GDLauncher__2.0.34__win__x64.exe
- Size 160.3MB
- SHA256 1663a66cdd6f56c056de09ca2b601e5c767ac5b08725109cf1c5f8068b89e540
- MD5 14e9c75871c168514913e191ce4b2235
- SHA1 a575884e523bb017818a557f64f586fbc3c32261
- SHA512 0456dcbc1ba3b38f09b6bd506a2d11f97ce954644bcc6958abd74dc0e70a26c8d1e7b9b847218d3220e5fa771b942d370b3bf1f4705058699dbdc7beb9f9ba21
- SSDEEP 3145728:z/qf2VRO5IJTknhaCK6T0dPWhFXn3ULBIrVDKB6N8p9673zw43aaCcD5XcZqGD:ef2VRunXT0lWzHUNIrV2yX3zw4dRDeZn
- TLSH
  T14D8833E063209F5BCEFACAB1ED83BAB15B946E0726C0D0014F97FC85D9D5998E84C51B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  GDLauncher.exe
- Size 202.2MB
- SHA256 f9967ae8e98d32939b9293697ea262bff526946068422aa4e9e57085f6036a94
- MD5 bd0f4cdb0e279a2a657d126b04410aeb
- SHA1 20abaf09bb2c7fd4e38cbe2e3fc84130570b5d9a
- SHA512 d6793b5bc03e161d4f4c580e77b049ad4e5093c93815d4cedbf24d19cf5919eb7363063d6d1a95c8f9c5acb01753251acdfd085395c8af50d576a4add538777d
- SSDEEP 1572864:9jVTaFNYgWzVdATDebM7M3c8ycaCXztxLphYFjItKKA+ZS6vqoM8MvvifefNg7YS:fUfR89
- TLSH
  T15FA88C13E29A01D9E05DD1B58B4A9633FE72B8054724A3DF2B540B962F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral6
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 2a58d970dc22c4dee982055a3cec18d296aa776ea636eeddae3a90ba9d4e1505
- MD5 38245a9da751c9c0846b1d9cef27933c
- SHA1 914b900008f0b30e63b24e0b31e6ec68061ff210
- SHA512 dbd996c3eb7bafae97b02027f3a030f8c7c168732338a6b79e03bc71ece201aefc4467c882b86926f5d6bfa4db41719e7071a09afc95ba9b7628c3d13baaf2bd
- SSDEEP 24576:vCNmjZ6doAjZ6/u3jK6UwR0ouDJjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jK65x:vXJeXqn8m1
- TLSH
  T1F5E6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 1e4e7d2093f7aef028e0c7f36b0dcc76a566f1504ac283df883c6a743e274db5
- MD5 7d14db15266dd7cfba438777b8d87587
- SHA1 67fa9a70e609e3582a4cb489800e1b37b0ae1a9c
- SHA512 8e9e0df31d9662db447fc4ab3aa6431f9a38f3ad62a982f679bcc3b3d250f61d1dd0adb79a68e1e27ea4d158597b89b4f488f6bff7e3fb4469f90c00daa5b618
- SSDEEP 196608:FyEM0iNA8dEVPgDaIq/DYfM0gAgzgiyM+lXx6JN:FyEM0i6MEE8sZiyfUr
- TLSH
  T13F4729122246949DF059C879C3678626CA2C34E73FA778EFC0F461252B7BEB85B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 1fa7173a5945213aaeccbd7bdd4ef318e3669f9786dc7229354af4afc4caea9f
- MD5 f279e3d2578d05693500772192787b0a
- SHA1 c7d6a20f1e18c1d9253b1f1f05ebc3de44a4919b
- SHA512 196bebc15879c63fead5857b58be64d6c690d3010808365d5499f74e88ae82dc5c9bcb138d89437561a5f5f55ecd1b21f6ad1732e90e6e8fbd098392d3b2be8d
- SSDEEP 49152:SESTAZFzTxMIP2uEeLfptJrj0vVJA8ANdZGNxcO6IhgiS9Nol7WtaRRqSorwIaGz:SDaTFEYht8OnZGNxcO6IhgiS9Nol7Wtl
- TLSH
  T10CE5AE03F6D650D9D029C57197AB9313F631380A4F2056EF2A804A253FA7FD86E7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 502KB
- SHA256 fe49f2d3b8d0605ed53368d8b28f86d2af591db035d5993907c5f9c2b3a5993c
- MD5 8bebcdb7aa2b618b1bf2d197eb121127
- SHA1 c5f531225a81d3d586e6a0c7d89e7d2c0e0cadfe
- SHA512 374ce8fbf1b89d3e99c85133f140a3b84e41873a0f58210dadf6a08d5a6038d0715f026cf781beb12412b15a938a70879a6d6c5b9053b69974c5ac4eff5379e0
- SSDEEP 6144:DtqwvC8uRreZw/wqbZyu5sIAeoZPw1ODZ6R3/8cWqR/H2plHoSZd30:ZqwvC8SrZ9NEIsPwa6R3/8cWqtIHoS/0
- TLSH
  T1FAB49E15F3E945A8E06AD4348B534603DA7278560B65FAEF03E092793F37BE45B3A324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 83431a4c121efbc8bb6914a62f7d19f8528e62c11fd5cfd6a1c0dc4f1068b013
- MD5 47beb5ede50630ee8a6361a3d6f41777
- SHA1 d3bdee6e5def37db9e1b23a8e91cd9c12396d24e
- SHA512 fca85efabe811ec36bbc86ee6f032beb1928993e2f0b46bd6f22d2ede438dedec973b18b2ee09226366c02a945406bbed7835c4476355d29456e4e70d24adb23
- SSDEEP 49152:7ACj6o+K5Wq6YogXd5ybJ2DYVCaVVnHVNukqUx0qSqfyOus4UUN4uVlMdgieDFd+:XVKgkTBSxRs5UhZHlr+hvhW8I/69DES
- TLSH
  T176867C03F68541D8C05DE2B8975BA327FA35B8490734B6CF2A9413152F6BBE0AB7E354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  owutility.dll
- Size 2.8MB
- SHA256 78e45eb7ab451623df63c14a82117479fd3ba55a6e617da5533d8fb6e6d16423
- MD5 589f1c9fadafbaf8c404b7d34debd991
- SHA1 df49b75a12dad10570dfbad5c5a58bf2338a57cf
- SHA512 aeb5bfd22b6dc23425935a952ffbf72967ac6dad86dfd2e8a75c159da77e29c8104471a7259898ec424313b0518d492e7e68b416d873f6cc8ba6a7034942bd17
- SSDEEP 49152:z3xsLRsfYDodxgEX2sP5z1zbIi1r8jj9IbamVA9/5OMbyB7ugVphXAQkhs6:zBNYDo/pPB1zbH82baV9hLK7uqky6
- TLSH
  T1FDD59D5763A551E8C12BC17DC586A94BF7F3BC290B35A3DB41A1932E1F73AE12A39310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/binaries/core_module.exe
- Size 48.8MB
- SHA256 e9b7d3b9aac91d9640805fcef22d2dc5afb4a8d6bfea15e48b0ff0ad2a779b5a
- MD5 ab83ccd48ffcb3090d2ceafd2026a6ed
- SHA1 577ee76405261d896de7386a30f633b4cbb32fb8
- SHA512 199abd8a9922419b24abfa373eaf011f73dd919a215d6721425dd8fb606bd9e9d0d2955a1a93c5183f15d23ffc7d32c9025f89302a748b2e7da05afa2a2a51e6
- SSDEEP 196608:l8fZI6z5OGrMnElqdAp3XuxhwZn9R3V9H970g3TBQKjOCHxmEVaDFi+Upsg:l8zMulqak49H9LTBQa9HxmEVqFiPsg
- TLSH
  T12DB7E6253B9AA96EC55AC8B0C34A4A735E6130DB0B35B9FB44C486353F79AF42B3C714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Drops file in System32 directory
behavioral15
- Target
  resources/elevate.exe
- Size 115KB
- SHA256 05cfaf464938c4a2e4ccb5996392f407e7c0538df7a3a1529292fbc6738eafc1
- MD5 ae05cda8d8273cc1e664e00cf78fe8e0
- SHA1 2aafaa1b6cb5964185f776ea3a9e673c401e7496
- SHA512 271c590470f0568355ef27c7daaafa3f553914a911c59413762adc8008d31f02fc97c9803830e3b13328a55651c11991577c70773db7e972bc684a87d316e7a2
- SSDEEP 3072:HCbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlV8:iPrwRhte1XsE1l+
- TLSH
  T1B0B37C1278C08471E5732A3559B4C9718E6DFD710E75DFAB6398027A4F602C0AA3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 9c01f98a5a8019a4b41990e6efcef1ca47f2d6438c7fa51b9bc1cf7565215a5f
- MD5 58ed001ee7974ca86e7425309de9ad37
- SHA1 d6e23ebce75496350e7053ec49e60faaefc7dfb6
- SHA512 36dd574c36e9b2c7b66b823dba8ae36c50c075b5357cd4583ca7f11179a7fd0b837eda196674de4e5230495b0ae7a3f40e05eaff6c2039390774612c199497b4
- SSDEEP 49152:Kf8J6ogB5C2csJiy2fY+sY2IKZ/s+OUvKW8yhj5PGhekCciy43Jvlj38HxiL2cWT:28U5C2csJijqwuHEr17D8cR08D
- TLSH
  T161462703F28681D9F06DE679875BA623F631F8844B2276DF16A01F192E67FE06739710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  vulkan-1.dll
- Size 932KB
- SHA256 981de5210eced2d33023c30cbce34db762129b92498da3fa78db8c306f6e0bc2
- MD5 fa9a7e07582d18dfc3f07206f5a840ea
- SHA1 ced5c5d877a0ab2032af0ef6012227bc82108fb9
- SHA512 a305a5d5c744cd612277125e968f34625f68224f3e14f72f2ae5c0de512f54ac9560a3f66bbce0137d16c2a0b9c944fd344ee8a91942574bea963bdad072395e
- SSDEEP 24576:WGVzDeAVM7N/L0H6tDVj3sF6Z5WGc4DYsHQDy6g3P0zAk79oOHAFt:WGlDeAq7N/L0H6FVLsF6Z5WGc4DYsHQQ
- TLSH
  T103156D23969485A9D47AD034D9D28707C9B174822316B9CF02A81708BF6FFF47B7DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  $R0/Uninstall GDLauncher.exe
- Size 268KB
- SHA256 750b070fae35b8a0f40c41d75af9903ad56bb38b2c45032a06b8248fb27d0d25
- MD5 56cf2215732e825f09bdf5018febe3f9
- SHA1 909196fe6ae6f876074668908a6da8f9870d1346
- SHA512 8da239fb75818aa7a687d0844e0c419647db828f832dd2088f317b6b059a7545d88137f9c9b787eb52abad1b71fb4676ebdc1d696811fc06387a276f2fc397c0
- SSDEEP 6144:x740IAEsb05ls2t0EyL+yaCDPFH6XdR+EkiH3y+:JHOeRKJCDPNKT1zH3d
- TLSH
  T138441212B2C0D413E8BB2F705AF896AB4EB1F40505715B4737C8AA9D3EA2791DE1D322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Enumerates processes with tasklist
  discovery
behavioral21

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

Drops file in System32 directory

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21