General
- Target SoftwareSetup.zip
- Size 80.5MB
- Sample260730-1kynqsga86
- SHA256 4d020453545d613f4edcf07962a1c0870e3dee05e45dd2bbeda8cb5d3b5bec73
Malware Config
Targets
-
- Target Setup.exe
- Size 77.6MB
- SHA256 c96026b440a78f8e545acce2f932418344a5fa04dccc172da7489e7e423f8b5a
Score10/10-
Windows security bypass
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target Installer.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
Score1/10 -
- Target libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
Score1/10 -
- Target resources/app/main.js
- Size 230KB
- SHA256 db6c21885728666dd56bfe7e85ecfb8289829f3dcbdcffcc2dd9a908906850eb
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.1MB
- SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
Score1/10 -
- Target vulkan-1.dll
- Size 932KB
- SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall Installer.exe
- Size 136KB
- SHA256 50b2e9e40f460153aaffb6c121bb1e7d06dbd13172279ddab044f73fddee1ac4
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
2Visual Basic
1Windows Command Shell
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Rundll32
1