General
- Target Nightlight.Launcher.Setup.5.2.6.exe
- Size 102.9MB
- Sample260727-e6ypzavygw
- SHA256 acdf4b27f24888e7fd62701221300a5e66719f693349db534faaf494bc618f85
Malware Config
Targets
-
- Target Nightlight.Launcher.Setup.5.2.6.exe
- Size 102.9MB
- SHA256 acdf4b27f24888e7fd62701221300a5e66719f693349db534faaf494bc618f85
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 102.3MB
- SHA256 359c9b2e646afe166791f549f9e8f53b6dfd0c2891171db12e1d07ce2e229463
Score1/10 -
- Target LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
Score3/10 -
- Target Nightlight Launcher.exe
- Size 221.6MB
- SHA256 ea7979cb60ff338e71620dc9d677d4ebb41328397c0e76f5b907eb2ea244912d
Score7/10-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target dxcompiler.dll
- Size 24.4MB
- SHA256 f0eecdc9bd3bd048b888b19c1be803867dc5592e9b0745914ef48781a3956d32
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 80d1ff5d7689071edae78164eacf92e4924689936d8cd818340377318b0a5da6
Score1/10 -
- Target libEGL.dll
- Size 467KB
- SHA256 380900fd2c24f14d602e5bf6d43c86f9c69362ac911d44f9609971a62735dbd7
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 d6a0d6700956b66e4b0d75f6cc102a9e0dfd7d923c5fba1ab227aa3cb0ba3b0b
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.3MB
- SHA256 ae7e65a4462a2f8fdfcfa7444259a8d2625ebd3bd75c170128025fa70e1ca037
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vulkan-1.dll
- Size 904KB
- SHA256 ef8b7e499fc34f5057c498702694de37fa87289ea3d866717fd1c001d955883f
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall Nightlight Launcher.exe
- Size 204KB
- SHA256 98ed31ca8ea439a970c93a20dac35a849e1c88dca065aff8b5e2efbd19bf46d3
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10