General
- Target DoubleBubble Setup 0.1.0.exe
- Size 172.2MB
- Sample260721-m8fk6sft71
- SHA256 d4153e8e4fa607ef3e1ceaeafbee57c3654f2fbcb7cb4ae9f2a34ead966497b3
Malware Config
Targets
-
- Target DoubleBubble Setup 0.1.0.exe
- Size 172.2MB
- SHA256 d4153e8e4fa607ef3e1ceaeafbee57c3654f2fbcb7cb4ae9f2a34ead966497b3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DoubleBubble.exe
- Size 215.1MB
- SHA256 31c672bfc6cb2bb9aed442277ed0d4e039b3ffe0d664e26cb7f00f08f2ceecb1
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
- Target LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
Score1/10 -
- Target dxcompiler.dll
- Size 24.4MB
- SHA256 a26f279fb9e49fef94d60710a8371f5f9cbeac73d92d6ad072a664c9c4442213
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 eaeb2203f72d89615ffbf6a38bb96860cc78a9095126b790e36fc91c8f1fef3d
Score1/10 -
- Target libEGL.dll
- Size 463KB
- SHA256 0c2960b094a77dba406e1401c6dcdc35245f218c7b910062d51cfac0f4898830
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 d254bf59b7e56730e56f58061ba83f0e75c0b393c4879a64560cc867d1f8e7f3
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/@tailwindcss/oxide-win32-x64-msvc/tailwindcss-oxide.win32-x64-msvc.node
- Size 3.0MB
- SHA256 09f5457067585ab96c76f03fd72667bc36f70834d1c054f42ab99969c2cac32f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/lightningcss-win32-x64-msvc/lightningcss.win32-x64-msvc.node
- Size 9.1MB
- SHA256 83e7e838ef1bbf5454c651103574fec31a1cec0b453b999d1173365cbc6c7841
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vk_swiftshader.dll
- Size 5.2MB
- SHA256 0fc94c88bf7cedaf866da5c959a1c52fd1b8ddb2d72185bd8fa2843fe9112e7c
Score1/10 -
- Target vulkan-1.dll
- Size 908KB
- SHA256 1843299ee154fc50d6d11ff5918742852d70467385e10b7a1019ea3358f3085a
Score1/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10