General
- Target geode-installer-v5.7.1-win.exe
- Size 46.3MB
- Sample260719-lt7wfagy4j
- SHA256 39d854e35cb9adbef66664ce8297db5093d58efcb85a87b8dab55d6afb4dc7e7
Malware Config
Targets
-
- Target geode-installer-v5.7.1-win.exe
- Size 46.3MB
- SHA256 39d854e35cb9adbef66664ce8297db5093d58efcb85a87b8dab55d6afb4dc7e7
Score7/10-
Loads dropped DLL
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 8KB
- SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Geode.dll
- Size 16.4MB
- SHA256 91e628e5e0430fe3f18153cbda761c16e46196adfc9af653ec46fb0561a8ebfd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target GeodeUninstaller.exe
- Size 159KB
- SHA256 ec5a783f7d936ca8b912cfb2c36794aace8a5b6793a705cc961402b01aac1f63
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 8KB
- SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
Score3/10 -
- Target GeodeUpdater.exe
- Size 70KB
- SHA256 0044a4be53d0fa1609de2729c5fbb5abc06c10153eef16f539233fe62e587a47
Score7/10-
Loads dropped DLL
-
- Target VC_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
Score4/10 -
- Target XInput1_4.dll
- Size 48KB
- SHA256 8129303a533f4b0480722f722c405c2969eccc2c9be464ff9c99d360eba6ffab
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.