General
- Target EqualizerAPO-x64-1.4.2.exe
- Size 11.4MB
- Sample260805-zpmxcsfr3t
- SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
Malware Config
Targets
-
- Target EqualizerAPO-x64-1.4.2.exe
- Size 11.4MB
- SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
Score7/10-
Loads dropped DLL
-
- Target $PLUGINSDIR/AccessControl.dll
- Size 13KB
- SHA256 933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f
Score3/10 -
- Target $PLUGINSDIR/NSISpcre.dll
- Size 164KB
- SHA256 43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 a6919f5f3b53a9c8c015413babe7a9872491a2583e49bb3c261e60785c3c3534
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsArray.dll
- Size 12KB
- SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Benchmark.exe
- Size 619KB
- SHA256 ab9df4be7234c2574937f00fcd5cc7867fc3882b746499b6a7801d77f03984d3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Configuration reference (online).url
- Size 167B
- SHA256 0386aba953d745c338636da1acba1941be7a5e18042ba74b63c6c047d17e75a2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Configuration tutorial (online).url
- Size 169B
- SHA256 f655030c56476500551b41bf2afd2545e728aa8674fd254700beeb0a21f1bb19
Score1/10 -
- Target DeviceSelector.exe
- Size 723KB
- SHA256 3e9f638ead596084cf3484ab22822090fbe58979bbf18c16ac95828bb73d02ee
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Editor.exe
- Size 1.7MB
- SHA256 77fd42c9eef32f5ab8d4feca0ddd7469d3850c9b443e47ad5b445a824adb78a2
Score1/10 -
- Target EqualizerAPO.dll
- Size 632KB
- SHA256 fb73fc8b94f271464ae4f83918bb3cb3243c4f50a8035c07fa538ad16ad66aa4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Core.dll
- Size 6.0MB
- SHA256 653a445d56044410903499952a2cc1ae575e059a75603a2b2a37b10d15db51f0
Score1/10 -
- Target Qt6Gui.dll
- Size 8.0MB
- SHA256 f710aab637560f64e759b2932fab383d01002436c73885a6d19b317e54d86bfc
Score1/10 -
- Target Qt6Network.dll
- Size 3.8MB
- SHA256 b9abac7aa2aa4598fdf93d4f69aec363d54cbe91331b23816158eed1c31b2a88
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1