General
- Target deskreen-ce-3.2.16-arm64.exe
- Size 98.7MB
- Sample260804-kljcfa1wex
- SHA256 98da0287583c25d6283c5f885479e86712bbda7e15b5f5980a8b395e4990e37b
Malware Config
Targets
-
- Target deskreen-ce-3.2.16-arm64.exe
- Size 98.7MB
- SHA256 98da0287583c25d6283c5f885479e86712bbda7e15b5f5980a8b395e4990e37b
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target Deskreen CE.exe
- Size 180.5MB
- SHA256 9b045c83f4b1754ec4c03d513b803028e3ca48d0b4b91ab888e743f38d3b4046
Score1/10 -
- Target LICENSES.chromium.html
- Size 14.6MB
- SHA256 6965e1b04dc81a012981508299e28542abff2bc7f418071c264f0b53e0c63f34
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target d3dcompiler_47.dll
- Size 7.6MB
- SHA256 fb702a71683777b08c9bc89a93eb87d0324ca195c9525ed73e15f137e332737e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target dxcompiler.dll
- Size 23.3MB
- SHA256 231063e5fb37e0596b387c5d35925719d9e59f1304c734b4e925bd19defa29d5
Score1/10 -
- Target dxil.dll
- Size 2.8MB
- SHA256 cd41e9f4a504bc4090c7ec217384db591905581c0c69eb57b76852e4a21904ce
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ffmpeg.dll
- Size 2.4MB
- SHA256 bc18cea015e8b33a53484769f69cb4723407727b2f23c746bb34cc5535744b85
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libEGL.dll
- Size 475KB
- SHA256 496cd86563d02bb7fe31b15358b6523384691ffd73c41db7dfa2a852ca80d322
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libGLESv2.dll
- Size 6.4MB
- SHA256 395df9343622a9b0c7fca9621b398861d73b15669f3da8b2a1dae9ca4d4125d1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/@roamhq/wrtc-win32-x64/index.js
- Size 41B
- SHA256 6d77257c9d50361fcc2286ed02bbcb0ffda7ffa204211d05c51b21c22e3b02fe
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/@roamhq/wrtc-win32-x64/wrtc.node
- Size 16.0MB
- SHA256 654c1a07c7d3be4e85e81ff67a64da2c99c3a4f118a03b9f45f8890c224da7f6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/jszip/.eslintrc.js
- Size 896B
- SHA256 0ddfbda0c594ca371f67baaa166734f5075d34ef56fdd2984f574564843c2a66
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/jszip/deps.js
- Size 1KB
- SHA256 35b1b517365d5935151333ef8b57048261b79573b765e96e5ba69aa0cc05a8bb
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/jszip/dist/jszip.js
- Size 365KB
- SHA256 e2e1be5c22d3f15b0b89e676d3eede94644529996d9898a6b1587c9908a78506
Score3/10