General
- Target v2.4.1.zip
- Size 82.7MB
- Sample260809-r7eppss1es
- SHA256 55191b1b8df805cd42e983547beaedbd02048d6d3c7a8880d4fc877525b6c4d0
Malware Config
Targets
-
- Target v2.4.1.zip
- Size 82.7MB
- SHA256 55191b1b8df805cd42e983547beaedbd02048d6d3c7a8880d4fc877525b6c4d0
Score1/10 -
- Target v2.4.1.exe
- Size 82.7MB
- SHA256 558ea3455eb08f8fd1221e31ce1847fe8f877243294e42e768e4db0ce311358a
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 82.2MB
- SHA256 21b0abeecc3f1319a7080465ffa9af9d2c2a48705a3c5c1db51373eec99be8a5
Score1/10 -
- Target Installer.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Windows security bypass
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
Score1/10 -
- Target libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
Score1/10 -
- Target locales/fa.pak
- Size 789KB
- SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
Score3/10 -
- Target locales/fi.pak
- Size 492KB
- SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
Score3/10 -
- Target locales/fil.pak
- Size 556KB
- SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
Score3/10 -
- Target locales/fr.pak
- Size 574KB
- SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
Score3/10 -
- Target locales/gu.pak
- Size 1.1MB
- SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
Score3/10 -
- Target locales/he.pak
- Size 691KB
- SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
Score3/10 -
- Target locales/hi.pak
- Size 1.2MB
- SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
Score3/10 -
- Target locales/hr.pak
- Size 535KB
- SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
Score3/10 -
- Target locales/hu.pak
- Size 576KB
- SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
Score3/10 -
- Target locales/id.pak
- Size 475KB
- SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
Score3/10 -
- Target locales/it.pak
- Size 523KB
- SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
Score3/10 -
- Target resources/app/main.js
- Size 232KB
- SHA256 440c88de570b33ed33a0403f1919e40fca9bc367aafbe686ca344c78e6c28d59
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target v8_context_snapshot.bin
- Size 663KB
- SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.1MB
- SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
Score1/10 -
- Target vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
Score3/10 -
- Target vulkan-1.dll
- Size 932KB
- SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall Installer.exe
- Size 136KB
- SHA256 d86b66c5abb8d7ab4a58d0aa1fe551776f5153a7223ffa14c8cdb495fb071398
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Visual Basic
1Windows Command Shell
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Rundll32
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1