General
- Target Togethers.exe
- Size 110.4MB
- Sample260808-z9k89sdp2w
- SHA256 19d06c8991a1be4ccfd2c8edace7c8a274adb8a763a23ae553c104ae17ef2815
Malware Config
Targets
-
- Target Togethers.exe
- Size 110.4MB
- SHA256 19d06c8991a1be4ccfd2c8edace7c8a274adb8a763a23ae553c104ae17ef2815
Score9/10-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 18.6MB
- SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
Score3/10 -
- Target TogetherSetup.exe
- Size 212.7MB
- SHA256 115b881523cf80d92447b180bbb4e953cea9e4ca41e294f3b32ef939ba144e12
Score9/10-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
Score1/10 -
- Target dxcompiler.dll
- Size 24.5MB
- SHA256 db72abfc0de76ff1504e240da07c1dfd8646ce46aa30df9bf4fb2258161f97d1
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
Score1/10 -
- Target ffmpeg.dll
- Size 3.0MB
- SHA256 ced08d56da30dc9671c088870f8cd0820fb5b43d568be5588d9934b883cce43a
Score1/10 -
- Target libEGL.dll
- Size 508KB
- SHA256 f158a8da0e8b6c56bcdac67ed95446df6f984ed192d895a5c8040a43e8343bef
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 c3e413e81f52f64415481daf16232e18ae19caa6b0cf2768a02a0a51d3436b60
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/datavault-win/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/datavault-win/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_arm64/koffi.node
- Size 1.5MB
- SHA256 4c730af0d6c84f2b88e22b80fb106b7af416deebe9a1c8e8336d6e4b1fce819f
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_ia32/koffi.node
- Size 1.4MB
- SHA256 7acaf95d9da7dd4e2c5823be5321dd6cda109c07c1079306c3216d1aa6688f8f
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_x64/koffi.node
- Size 1.5MB
- SHA256 ef05047b3ec7fb73e74c96113f67bf878ad74a9e4eaef20ec3f83317460a2bbb
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_arm64/koffi.node
- Size 1.5MB
- SHA256 da394ea5d8f28cf8e90c6b1bbc3f35485adb24f36dc36265806967213c235a50
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
11System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
5