ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d

Sharing

Copy URL Twitter E-mail

General

Target
ExLoader_Installer.zip
Size 23.7MB
Sample260805-xss7faztex
SHA256 ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d
MD5 a2a1f6f0c76f692a721292df8e6f779d
SHA1 d38d053bb541abdc1fbc5531d8c66aeb430b3d32
SHA512 748ce3e79b7c69b6d04360853739ce47823a0aab221ddff5edad50baaa12d048b3f12395d223b72ba9a95c1a9292d6a713cbff89203c862d8f2bc0ce031b0434
SSDEEP 393216:kN6+R5xTUGIk2iG0Y9mpiRwWvPUJ2bQ1GEfruhFIpmEsUX35pt8xtyPHjCQo6Cw8:kN7RFIkYmiwWvC20buTmm+Wxy+QumW5n
TLSH
T1D94733C1DB9160A7CD36A7B3857CB0B2D308229F62F35634859CC3606E4BEA8D615FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ExLoader_Installer.exe
- Size 173KB
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH
  T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1
- Target
  audioplayers_windows_plugin.dll
- Size 201KB
- SHA256 2680c92a0203df659f00de9bb4c350a24096c3714fef18b6649d89666ec876a1
- MD5 e900064072e30b4017616d0a4ecd5c08
- SHA1 2393bdb97fd6e1f3ea88abf404e54587ee3d56fc
- SHA512 042bcd97e959acd17a39b7d2e1d84cfb9613d22770df11a5b5f62b8fb61118b342908777747e67a059d37956fd10d86d137d7d682b3fdb8d84993867daa4bff5
- SSDEEP 3072:s1GSXZSEkye+EkyNqQU+hicfZ6Nq4yOkMYYqtMH7wEy5v7tR7jEEZZ:iFXZ6lqSicfZCyUH7wEy5v7tR7jE4
- TLSH
  T19B143B2AB6684097E227D0BCCD474916FB73B8951B61A7CB27900BBE1F27BE45E3D500
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  data/app.so
- Size 21.6MB
- SHA256 bb87ccb65b9c9da39d4380451a0682337f3f7cc23342efdf961aedc103afeb13
- MD5 e7a5a612dedc1457e3eb0360b1d26705
- SHA1 d8417fe077f7d029222edbb2d28be3f7c2b1072f
- SHA512 a4b6fe63b7f54eb00d52409c912e3d22079c1c6883d982a5bccb4cd5646fc1c89392b796b30b9eb0c91bcba50cd691e391f0d5a1e9c3daadc455e8e9e0ec0d14
- SSDEEP 196608:T/NcxG5wmYwdcaENwQ79for3nG6PCJBWTEOPdfhbq2JWqCbTx:TlcI57lEEe
- TLSH
  T1D0373B07D0A44324E4B3E735F77FB9929E543DE84A30A68A16C617193A4ADF0979F332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution persistence
behavioral3
- Target
  flutter_windows.dll
- Size 20.3MB
- SHA256 011e87e890b7bfbac89f63c763341ffb8393d2b4a617dd836c471a0cdaa1346f
- MD5 ae8508a20a3c598ae3668aeb39633755
- SHA1 1052c38074e8836da5becf616cbd147775e9400f
- SHA512 61781fad83efc462ae5dbb616e1b0a2a30e6f35fdb63926913c1c0172f8302f9c39f4e8c2bf1a9a18c0cdab1199eae03c5a4a683248a3e180cce07245643453c
- SSDEEP 98304:FE7hoeyV+kw1ULtPbwDggwZr3hH5epehPTuwTlckSTKZSx8tkvMzVdD+cWUN25el:F3IgBfefQzH7wpuIFybvI9YA4V
- TLSH
  T132276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47253F66BE01B3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  permission_handler_windows_plugin.dll
- Size 113KB
- SHA256 6115910d401645c079cd6a1eb76c27717d9692289b8747160fd152d702702459
- MD5 332193f149eb2495b5a3566a21972c69
- SHA1 8cb8ea1fa42388c5d0c590ba14214cdb8287f025
- SHA512 aa72cf2f477018742314859052c9cf157e21b48a269b2222117615f593ce1c826fd39cc23c331f178b99d9ac64913597092acb0645f3a84fab5776026a3c1ca8
- SSDEEP 3072:j2tYwQpJGaseTQiz8MxhogPdYC5vT4AzoGBbA:aYwQfGaeizRuC5vT4AzoGB
- TLSH
  T114B32B2AFA69416BD22AD57CCE974A05CF72B84517A197CF63500B9E0F23BE44F3E610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  url_launcher_windows_plugin.dll
- Size 96KB
- SHA256 71086a2b5361259a8a45c7f009a38d8ee4be2d50ffe4bc28b1b8695063cc7fc8
- MD5 437e545ef64648d8b9b0affa2c265d74
- SHA1 9c2dca4605068824f8da3df65089f7f37e254c88
- SHA512 8e3a6ee86e8df21996c771ba4126795603c41572e3d5b85463a5734c653eecc5c879550bc4ec1074a22cc97c3ce68909b3156bb2ce0e1fc9f6f1986f76774a23
- SSDEEP 1536:f347yxZcZiRaWEi6X/j27otOgBUJZmU5rUVrJV1zO:fDxZcZWnEiibZgR5rUVrJV1
- TLSH
  T187A32A2AEA5D40AFE22AD4BCCA574D01CB72FC85476167CF27905EDA0E27BD90E3E501
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks for any installed AV software in registry

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9