General
- Target Ether Ultimate Optimizer_6.8.7_x64-setup.exe
- Size 8.2MB
- Sample260807-ydmlsasdmc
- SHA256 8be64ae7c43b8b8ae6c6621e72ff5ac82fc649aba349a7fc3ff1fa3980d1a861
Malware Config
Targets
-
- Target Ether Ultimate Optimizer_6.8.7_x64-setup.exe
- Size 8.2MB
- SHA256 8be64ae7c43b8b8ae6c6621e72ff5ac82fc649aba349a7fc3ff1fa3980d1a861
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
Score3/10 -
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score3/10 -
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
Score3/10 -
- Target ether-ultimate-optimizer.exe
- Size 33.8MB
- SHA256 23c0feed1d99b679bdedcedc1c66592a014df3966717816f10738ff3cd067607
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
- Target uninstall.exe
- Size 77KB
- SHA256 53123ecb099642ff1f8e29180a866c7c98077fe43adcb730f71cd6acb9fb6815
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL