General
- Target FNLB Setup 2.0.9.exe
- Size 154.2MB
- Sample260807-c4czdaep9w
- SHA256 ce19269e09769a11ef92454e30cf5feaa5e365d37c32fb89182e933d1e18ed7f
Malware Config
Targets
-
- Target FNLB Setup 2.0.9.exe
- Size 154.2MB
- SHA256 ce19269e09769a11ef92454e30cf5feaa5e365d37c32fb89182e933d1e18ed7f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target FNLB.exe
- Size 164.3MB
- SHA256 83d182697c329eacd037d26ecea81c0359f8ae6c1e000388fcb7f79270820953
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target LICENSES.chromium.html
- Size 14.5MB
- SHA256 c54df6af4da6dbe8199869b48d1a7c8c457bd96441d944377b83e173af2bb2f7
Score3/10 -
- Target d3dcompiler_47.dll
- Size 3.9MB
- SHA256 51eea17ebde38f7edb0804c1fdf6cba05c72de90ef0a435824d9940281658922
Score3/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 8f401581add5170cc5cd8a27c1c02172c3d6a470f00424e22959ebe2588303aa
Score3/10 -
- Target libEGL.dll
- Size 389KB
- SHA256 ea290b45becf02c0300bd1d4455f2951e2877133a1098492e76690e85b043a84
Score3/10 -
- Target libGLESv2.dll
- Size 6.7MB
- SHA256 75f1f6a33f02418134626cecb5b6c71e9f331114347344bfec388b4437efda89
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vk_swiftshader.dll
- Size 4.7MB
- SHA256 bc8e13f16d2abfd66e3e1b705fee38bac540a4fff1288e559ee3fe661c7ff16b
Score3/10 -
- Target vulkan-1.dll
- Size 771KB
- SHA256 c178d17fa560d947600550e12807f31535b8ff8cdcfc9a901b6311e81148fff6
Score3/10 -
- Target FNLB.exe
- Size 193.3MB
- SHA256 673f7f9ccf4c9bcae8acf5f0cd861ef1332f9a0bfac0d8f61b1b1aa11eec45eb
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target LICENSES.chromium.html
- Size 14.5MB
- SHA256 c54df6af4da6dbe8199869b48d1a7c8c457bd96441d944377b83e173af2bb2f7
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 9da80727db8bb2760ece1aa5dc2a2ce9920e1794bed6de0ae63ec21924349a8a
Score1/10 -
- Target libEGL.dll
- Size 481KB
- SHA256 a6d315c7ea7c240f6c82afa57b39b96191a62d3f5a0d25982e8567395ecb4694
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 71cc200c14725793888932d63142bda9ca6b4d2988c7e16d44387351c56d68a8
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vk_swiftshader.dll
- Size 5.3MB
- SHA256 d61ad23a0a6d3247db5bccc1e13d00be89ee6804cce17cf9dcb156705441fba4
Score1/10 -
- Target vulkan-1.dll
- Size 886KB
- SHA256 3871c971466dc0c38e69a857a1d572b5d94e12f54b12415335cb83638680d508
Score1/10