a0427a2cdd11cbbc5a5e79d5fe3c79a5922540bd75350edee8423facea489783

Sharing

Copy URL Twitter E-mail

General

Target
Exploit_Launcher.exe
Size 86.1MB
Sample260722-grjcvadr5x
SHA256 a0427a2cdd11cbbc5a5e79d5fe3c79a5922540bd75350edee8423facea489783
MD5 44208c037d62fa9a0528450b6fbed316
SHA1 f06168fe8808567e1c3a2986bcf355160268024d
SHA512 f2373f803b4639b1023fe75066a5790fcdd42f935adcc4ded28279768191406ab39940f64a9a9dc8a92c02ab0ef488c5b7a9b9ec8312a8f4718f063f32e791fd
SSDEEP 1572864:vge4hdV6xfMCginFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzS:vge4DoxfMCFnF7z3V7vl385ySor0TzS
TLSH
T166183321855206BECE55AF3490F1A33641BFBF76AF30A13F09A6B58DAD33A4B5470C16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Exploit_Launcher.exe
- Size 86.1MB
- SHA256 a0427a2cdd11cbbc5a5e79d5fe3c79a5922540bd75350edee8423facea489783
- MD5 44208c037d62fa9a0528450b6fbed316
- SHA1 f06168fe8808567e1c3a2986bcf355160268024d
- SHA512 f2373f803b4639b1023fe75066a5790fcdd42f935adcc4ded28279768191406ab39940f64a9a9dc8a92c02ab0ef488c5b7a9b9ec8312a8f4718f063f32e791fd
- SSDEEP 1572864:vge4hdV6xfMCginFt90c3Hkc7M0zLr1X3OznfxySo3RPqSlfVDWTzS:vge4DoxfMCFnF7z3V7vl385ySor0TzS
- TLSH
  T166183321855206BECE55AF3490F1A33641BFBF76AF30A13F09A6B58DAD33A4B5470C16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/app.asar.unpacked/node_modules/koffi/src/koffi/src/init.js
- Size 3KB
- SHA256 76c95aba02c0e8b2df4a0580af41c65f5a2fab8dbbc86cc02e6eb177268d0d9b
- MD5 794d621d8cedff7fb5f6cdcb7ec0fbd7
- SHA1 ce812ea504834f075efdca10cd679af37a43f61e
- SHA512 4238ef4f656793ad292c6c167f6f4079db4438321a0c94b78ad18d93f78e8a76186a44583adf8f009e7b8772edcf98c9a61b9f4ad8f29e135076f3d0509a18bc
- TLSH
  T1F781532E23EB90A1AB527368A68B50D556B9C02302145B147D8C9382BFDC47C87F7AB4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/napi-inl.h
- Size 230KB
- SHA256 797668948d7f2df0ee8fcfe734af5b55942768bc7e15e77196a1f1107bba3635
- MD5 a9252880de2b63d2584a0dfccfbbc837
- SHA1 5b83588083a8824c0905aee4867c576d78473a3a
- SHA512 dfe26b6491340589583e6173dcd253d3521413817eafc4b8a36386da56b726e27fb0fd59671d063ca77ea50902dd80c9bb88215c06248ae1aef1e5d815622939
- SSDEEP 6144:2dPvxWsSKWEkRBa8iOV65+04Ho8mhRFf3j/LtapJiK7wflzb/QNJnThjbdD75kZW:2dP5WsYEkRBa8iOV65+04Ho8mhRFf3jO
- TLSH
  T14A34A61436E5F1012A62E723682A92519E19943B2F3CDF90F1DDB3247F805BEB13A797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- TLSH
  T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/binding/napi-v6-win32-unknown-x64/node_sqlite3.node
- Size 1.8MB
- SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
- MD5 3072b68e3c226aff39e6782d025f25a8
- SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
- SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
- SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
- TLSH
  T114858E0BA2B400BDC1EBC179861B560BE7B174051774ABEF15D48AA96F23FE3567E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
- Size 241B
- SHA256 049b7b1b10417274be6c3e6a9518ac364729354435298d70abf834c35e8f3bf3
- MD5 ff6a0462767c6bf185a566f4aef65ba5
- SHA1 7a3c3ee6748d00fac6e51e366518bb48a41794bb
- SHA512 088d706f5a18323128547b0f126564fb7fa7a36dc8365ee8287663b2cb63da2d02a991bc5cda19af24da2aa063357c25f21347835f9a8aaef341b33bd21127df
- TLSH
  T1F6D0A9F422A57264A6F0A783EB9274432987C6F1330380C8E90DDDF2207B4C82BE2D84
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
- Size 6KB
- SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- MD5 275019a4199a84cfd18abd0f1ae497aa
- SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
- SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
- SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
- TLSH
  T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
- Size 1KB
- SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- MD5 e5c2de3c74bc66d4906bb34591859a5f
- SHA1 37ec527d9798d43898108080506126b4146334e7
- SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
- TLSH
  T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/node-addon-api/index.js
- Size 296B
- SHA256 6528e924b31e091c3243132fe713ea0f1fa6362ffaa3c2dd09d12670db6b60dc
- MD5 b6cc90d5b932a30e0f0ccc50ad604b14
- SHA1 8adc616fc0a9aebdfce536aa9bf7e552fafdc403
- SHA512 11c964d1b60030c9f750ebf078f46836238b4d4334bbbf1a85f32c759111ea6099fac1c827c88a17b8d17876583eea357dad2d55f3cbbac14690a58cd0cbec5d
- TLSH
  T10CE0C26A657C2120A855CA61F3D489120C89F0BAEB5624D4828939D5E98F9D05277CE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/node-addon-api/napi-inl.h
- Size 199KB
- SHA256 141fee09a5439de973314b4ddb783a09e74a097f7ddfc5e3b994764a182e3795
- MD5 85df6cb613db042d15ec04e84492c23f
- SHA1 487ea0f23d70e7692f5b78cd6ae8c77934ae39da
- SHA512 862d8c0d8bb75f408373c87231b40441c2d4b6f776a7ee3dfa2fe72406b58c0aa24772861f83590bc047f237e02597e0f731889936369c2c83e5896a39514667
- SSDEEP 6144:HuOR3ut9puE/wnOFGP6Dl8TIFWwaRJy+XcDdz7/QNjw7Nvt38yZXobBHbtR7VX3V:HuQut9puE/wnOFGP6Dl8TIFWwaRJy+XH
- TLSH
  T1B514A61436E6F2102A63E7236C1B92109E15543B2F3CDB91F1DDB7247F805AEB23A697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/node-addon-api/napi.h
- Size 118KB
- SHA256 38ece42f702d0226ecd63c8b9f0a13e71368d55944994bd2954dc142efdde669
- MD5 f6d9f20c11573476b1937b6fc4d2efef
- SHA1 e1f46759c59c5035eb44b5a30beaee3b8eecb6bc
- SHA512 a15738b1e7ba569c41774507ff07330f6d2b728b3b405614b396e18c216c59931041a66f602620d06d56698891f8ca7864157b86a0afff3a26946504d5e3c538
- SSDEEP 3072:I/0531/VtvS6L9viD8XHJePph0gE8I6WDvMG:I/0nVtvS6L9viD8XHJePpGgE8I6WDr
- TLSH
  T1C4C3C8047B62E7A10DA295D28B3B7261CF118023BF34D1D0B5EF57085F9646AA3367EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/sqlite3/node_modules/node-addon-api/tools/check-napi.js
- Size 3KB
- SHA256 f3264fd3f9dd9bc3e051cdcf72125d34617b2b06b914c49f1e1297e53cfd524b
- MD5 e0319363c4e8d95a44a00bf037061414
- SHA1 2e3895647ccdb1d20eea6c325d32f7e12f4d7f2c
- SHA512 3555a6f001dc983eaeb6f63368dc7c6c3962003b73f15991112e16e8942b90b83f8aa83e16ae35eb076db9422924b9aac00d7ad312b27589b10264fc249b3915
- TLSH
  T16C61109912FD12A340F7363A5B4E8029B22542A7432DDE24BE9D47183F9057283F2BE7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32