308d406ce8aafef3e4b4e1c81d97186c84e881c9de8d9e64719870db3d73d8df

Sharing

Copy URL Twitter E-mail

General

Target
PineconeMC-Windows-MinGW-w64-Setup-11.0.3.exe
Size 42.0MB
Sample260727-e3xcqsvyf1
SHA256 308d406ce8aafef3e4b4e1c81d97186c84e881c9de8d9e64719870db3d73d8df
MD5 548948690f291dd3b2f5b5f9d369da06
SHA1 12b1c1c832b822ab1dab922cc8f50a4bcf20359e
SHA512 1eed0bbbfb9fb3eedd24478fbc6ec4b53451c849f18ecd5b4225df80370953111272f96ce9f2b4e65d4820976fc8af594eee7e7f85746880294b15c08dfc5526
SSDEEP 786432:tihNUml8xuILI5z9aQJF1kW8vwWas5ZFyYh0woh0wgOVFhgldjx+4nfvy5G8ZTdO:t6NUmlKuIQzEQdkW8Qs5WYhQh0wpVzg9
TLSH
T184A733B290BFD94EF06DE63E05B56A0E347EAE1126713319FEA1BEC344F9350B415A18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  PineconeMC-Windows-MinGW-w64-Setup-11.0.3.exe
- Size 42.0MB
- SHA256 308d406ce8aafef3e4b4e1c81d97186c84e881c9de8d9e64719870db3d73d8df
- MD5 548948690f291dd3b2f5b5f9d369da06
- SHA1 12b1c1c832b822ab1dab922cc8f50a4bcf20359e
- SHA512 1eed0bbbfb9fb3eedd24478fbc6ec4b53451c849f18ecd5b4225df80370953111272f96ce9f2b4e65d4820976fc8af594eee7e7f85746880294b15c08dfc5526
- SSDEEP 786432:tihNUml8xuILI5z9aQJF1kW8vwWas5ZFyYh0woh0wgOVFhgldjx+4nfvy5G8ZTdO:t6NUmlKuIQzEQdkW8Qs5WYhQh0wpVzg9
- TLSH
  T184A733B290BFD94EF06DE63E05B56A0E347EAE1126713319FEA1BEC344F9350B415A18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH
  T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Qt6Core.dll
- Size 7.4MB
- SHA256 e570e239af6abdea1e930dfb3c0d568c1ae3f87c34a4b02fd213284219050b34
- MD5 1a20685496d844497fabfb94f24d09d7
- SHA1 3de58f39611d6c52e349b5770c896562a6e005fd
- SHA512 ba9d045f9900e83c059f3a731b562b636dec3ce42e9238da60bb6f08dcad03b6cc40a603764f5f66b00815462e3800c4f6a31d0017b82ed7de97e8b91002da02
- SSDEEP 98304:92vaQD+nXtWLRX8FNF2uMcZdVKFdu9CwJsv6tb09WIsiWvGlNWP0EKXgXCFlW7/:9kGxyuM+KFdu9CwJsv6to9
- TLSH
  T1C4764B42B28691A9F46DD334DAC72322F9327C828B3669EB47849B356D67BD4173F301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Qt6Gui.dll
- Size 10.4MB
- SHA256 af7db34e128100d485a1bc49f28a4704186a40552bf3ee8d0fe7863e9c7e392a
- MD5 2f060b0fb92670c5a962e3884a20db85
- SHA1 8938c7a2a1084365a0a9647e25e3262f6495789b
- SHA512 f859504dff9fbb38a772ff9671700109407c72f1946511d58cc71ec030543c6bbc997633e45a949720fbb0ed2edf0c4430029473f507fb8c4439d8e6efa76a61
- SSDEEP 196608:XPv1+wasi5GUXf7KfMBVSYtkpCycEv60/4h:XPt+wasi5GUXf7KfMBVSYtkpCyjvQ
- TLSH
  T1F8B65B42B64295ADE41AD6349AC76323F9317C454B76A9EB43808B393FB3BD0273E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Qt6Network.dll
- Size 2.3MB
- SHA256 900ff1b0cd76d698321e40f27da96c618275493588bfd76148067a227f26548b
- MD5 90421c7e353160555fc672db3e456c01
- SHA1 39d211789369b0148628288e89ea4779804c3dab
- SHA512 6cba6712d27ebd41d398f5a1f4a069ad2c2350b89462b812d9aebdd8a2dd10bf03e873e0bc7ccd45f86b0d758dbce03260007a8989abf01590ea074cd8d10f9e
- SSDEEP 24576:2ujxoGjyNlIQgmsu5lZaobxC45iR43ZuR2SE1CqZd/W/aZq47S5qxk6bjb:Hjxbj+lH575mECTkZukS6ZdOYFxksjb
- TLSH
  T120B54A42B64195AEE85DD634DA876327F83578418B3AE5FB8780877A3E97BE0133D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Qt6NetworkAuth.dll
- Size 384KB
- SHA256 ca8803cfbf3e6ac57d4e6501fd6c6ab2728f4b9384816bebb6d4b9ca4092469e
- MD5 941b2acbf1c9fd4f40710544d6ee2514
- SHA1 e3cc2bcebddd0da3f7b67265697608ab02cc4f5f
- SHA512 231dca2fbade2488c0de98f06edc2fbe45f0df7210cc12ca0fc9fa927c4547b2618e66be30d1f23d8a51ec3606483d6ee76bec42a8ce783b8a5c626766fe5eb1
- SSDEEP 6144:iAQxjfeyam33FpGyK67S2F1jpqFbstcDlvy0mvK2Qf6FQaadmn:iAQxjfeyjn1LF+9yzF8
- TLSH
  T14A840752B301959AE85AC639EDC75333F532B8018B7BE9EB478083752E97BD06739780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Qt6OpenGL.dll
- Size 3.3MB
- SHA256 41aa14d55f031055c97b78eaaca14004fe61b6e0890256aa93907cb321af43f4
- MD5 5cdc1412241bd406f8b1ee1ea0e60f23
- SHA1 dbce8c2eec72dac9ce557575a70381fdec1d56a8
- SHA512 71e104838e1eba091f5f92cbe0790e150341db5c209e24650005dd05b8f43fe2404a3f79a5778b3e8c0b66ca8fde92390b0df51007cea168eed8ac91e23a2bec
- SSDEEP 49152:P0iDPnGwMnnYwDMJI9CoRaiBRrway4RnlK/8PERWLF:P02nfMYwDMJI9CoRxp/RnlK/8PERWLF
- TLSH
  T1E7F5CCD56044FA26C9A31ABBE34F123DF1F9FDD0C36E51C3948457A41D606EA07BAE0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Qt6Svg.dll
- Size 711KB
- SHA256 e7a410b29979a3d0cac563b66ac52df6e23fc9746396250dd874b23f82d366a9
- MD5 ae4cd20862249f46165eda3e956f28a5
- SHA1 fe742c9ec1e543e79edee908b4c1b03cd48d9555
- SHA512 e6a77edeff2a8e1a93a6508e64b9dff4158808e920fa530c1ae968eaff1461d1e72aa816fc989afedebf0665d3cf207f842c6319f2c7bbe6cd900cbb7d9f01c9
- SSDEEP 6144:208y79a8GFIiwIuXWoZaRO7XJoXqGuA/yXXzxIRAvo0Ttc/rvIdEmOF:vf791GFIiwIAtA/89Eg9OF
- TLSH
  T179F41742F74245AEE85ACA3C96871232F6327C0517BAA4FB57804B357EA7BE4533DB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Qt6Widgets.dll
- Size 8.2MB
- SHA256 d3a62cfeb078b83cbb0e02d7ac68e572eb341be904fcee46ec901b4853c8fb38
- MD5 80af5899eacd1e69169b9032669c5dbf
- SHA1 ea56aae61e7dc17497a65523f7640c981fd147b3
- SHA512 80b181f6c9f748b67fe8e0855294423a5257b60fccdb195ad4118a5ebc2f2e4ced4c6f245444fe191d9b82dfa042893fb2f533cc84046da24902cc86f98982b0
- SSDEEP 98304:RP/X3bcKBKUUg1bslOlmgokr+9/ufei0oypiZCXHTyo3fBB7c1fL:JARUUmYcG8ZCXz9vBBm
- TLSH
  T1F8863A42B24295ADD85ADA38CEC75323F93178858B37A9EF468047393EA77E0173E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Qt6Xml.dll
- Size 201KB
- SHA256 f8460add5698dd144e090c72d2e31a7095d295b0b0d37735085df7c91ff15844
- MD5 11a24afc4d67501382d3716a69b1076f
- SHA1 888d345966bd10b33c2e003b44042f094f9a9135
- SHA512 e0f2be4979f81b22f31e70c3eb3c5161878eb96a642adf507c03d58015d4b2107eb6f4209f7d3d3bfb44f2b8c4090cda046e4ca47d174593093f80599542696f
- SSDEEP 3072:Yutz/Zt9NQ8+7WHg4BhE26UsMtNMurcDbGSEEZ:YutZtQaHvi26AtS1DF
- TLSH
  T12114C3A2B286C59AF856D6349997032BF575B8811F37A8FBDA8047342E67FC4233C744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  elyprismlauncher.exe
- Size 20.1MB
- SHA256 241f9b459ea3eaa9f5574d97da76f8ae51ea3d74f9013e97fb364e3040790cd2
- MD5 66800fc91a2bbf4f293e8f6bad78c489
- SHA1 8e9920b130a0e51fee5ef142c3b6e77b7ea2b35e
- SHA512 421b079a386487e2464a5bcc52e6bf73975b4864ceaf365a16dae761ed7418f054a13141191f920a0efd8093c4cd1b4d7c0064bbce2eeb5b8d369f842b01b7ac
- SSDEEP 98304:4UWjPM2fc3Yl9+mkfg6cn+HPidRDbEOZMEKr:H3YlImkfXBv
- TLSH
  T18F27E507A79185EAC416C57CA7A96237F1717C8E5BB2E2E76B851B227F943E0B03C704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26
- Target
  elyprismlauncher_filelink.exe
- Size 799KB
- SHA256 1eae2eb2d6d3ad9b4c26bc70f56cbbd776ed591e642ff279e78b5915aedab7c6
- MD5 3c830c357ca2097ab55fbd1770f47b62
- SHA1 3d95b24ae91664a6bd0a2fd7c356be8a5e8d732c
- SHA512 227b3650bf7816ae11db8b5a8745586b8deff59503dc16c76ffd05cd0267e9f8d5ba26633066521dc752208d8fe639a7a6eca2a5f408f6f3dd27fb02d7be71cd
- SSDEEP 24576:aX+Y7zb0ZtOVGp6nscH+PDh/iDdDNA4AWkD:WCvonscH+PDmdDNA4AWy
- TLSH
  T1FF0519086240E7E7C85BC73E5AD5A912B27034449B67DBE31A440E387DA7BC27D7DB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  elyprismlauncher_updater.exe
- Size 1.5MB
- SHA256 e7a18e99e9fd1da4bc5d1b2da2d6554de084970c0269684efa5e8631159813e0
- MD5 c9d67c0dc5516e4c1425a42a1b40f1d3
- SHA1 38250982d934b138094286e5fd37bd0e4ce44971
- SHA512 31fd907bd28a422632b836f0e6713877522c857f5fb12aef0bac63c62660b9c3e9d28db18c089b901f9241ffc30ddbaf249c78e6249c4f35106a0d85cfb1b6b6
- SSDEEP 49152:Hsht+2+Wk6IlIj2t5yOQ2NH1GKTwC7P4/NNNNNdVIYDMu9S6rXvY:8jDMu9S60
- TLSH
  T1C375D40A665096E7C857C63CABE5A523F270388D5BB7E7A347800F367E947D1A83CB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral29 behavioral30
- Target
  iconengines/qsvgicon.dll
- Size 69KB
- SHA256 41ce3a000b9eec978e6d3c8566d713ecac7b2e0c2706328bbc47821104fc313f
- MD5 26bbb75559e6ae4db2bd86620c3b6731
- SHA1 5abbbd5ee5d74c2d592fd99e8c869ae5055c827b
- SHA512 449746a10dbb74e60a0c8fc2d9c2253ba06f9ebf0ee05bdf8e227f9e0ee1cd26e397cdae79ba2923f2464f25b7be267a763001f76a3d69122b881223a18885c1
- SSDEEP 768:7Ff+5WXt5bLHdUAT/gurclN9bOZeqxePdGY0StMXl/1nDiUtIxDbdV3TfCVIF/FF:xAMXbVdc9NDG1PtGDbdVDfCk
- TLSH
  T18F633C21A745969FE8D7D73CC5CB1362F836F8821B2798E74680523A7E67BD41338B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32