General
- Target Setup.zip
- Size 148.9MB
- Sample260722-dgnm2acm91
- SHA256 6dab44aaf0544f57ee2ccf868bce078c74a275cdd77aad9aa26e65674cfe491f
Malware Config
Targets
-
- Target Setup.zip
- Size 148.9MB
- SHA256 6dab44aaf0544f57ee2ccf868bce078c74a275cdd77aad9aa26e65674cfe491f
Score1/10 -
- Target Setup.exe
- Size 72.9MB
- SHA256 f92e8b25aa7f99b6ca1767096bb8ea9629098040fabe79e6648005f690a5af4f
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target launcher.exe
- Size 70.4MB
- SHA256 db51bb8ff0e3140b61af25c4010021ceeb078f8f4040f978ec21a54373a85510
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 70.0MB
- SHA256 c39cd9b73f6c136634277876c261f3743c0533b63dc70df0b9641a38644e8dfd
Score1/10 -
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score1/10 -
- Target chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
Score3/10 -
- Target chrome_200_percent.pak
- Size 229KB
- SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
Score3/10 -
- Target icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
Score3/10 -
- Target locales/af.pak
- Size 478KB
- SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
Score3/10 -
- Target locales/am.pak
- Size 776KB
- SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
Score3/10 -
- Target locales/ar.pak
- Size 851KB
- SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
Score3/10 -
- Target locales/bg.pak
- Size 885KB
- SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
Score3/10 -
- Target locales/bn.pak
- Size 1.1MB
- SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
Score3/10 -
- Target locales/ca.pak
- Size 538KB
- SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
2Visual Basic
1Windows Command Shell
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1