6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c

Sharing

Copy URL Twitter E-mail

General

Target
Era Setup 3.0.9.exe
Size 149.5MB
Sample260810-jp87layvcx
SHA256 6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c
MD5 29aa22e73404ea3ba76749b43c853b2c
SHA1 44db0ffab8ecc915e1b52cc5268341f79e28c40d
SHA512 2eba84e45559dc98e150919244421a14d44600a68d85f10d01521b2041a326be27809bae76e93efbc4306722b2b6d2443d9f18c25d0f65c5d5d80de5357f92c7
SSDEEP 3145728:pLwCzwwpkOvHUMcbAwROoKrumGLWsyK9kEv/LKPXD0LADLo:lZtUMcbAwUon/WsyK9f/uXoULo
TLSH
T11B7833C7CC159C0BD521F47E87A06EBB0D413C6BD68136839B62FDA0A8F7891DF68856
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Era Setup 3.0.9.exe
- Size 149.5MB
- SHA256 6b326fd1cf9a586d8ccad6395afb180f69351b313443501f2866099f2e02b73c
- MD5 29aa22e73404ea3ba76749b43c853b2c
- SHA1 44db0ffab8ecc915e1b52cc5268341f79e28c40d
- SHA512 2eba84e45559dc98e150919244421a14d44600a68d85f10d01521b2041a326be27809bae76e93efbc4306722b2b6d2443d9f18c25d0f65c5d5d80de5357f92c7
- SSDEEP 3145728:pLwCzwwpkOvHUMcbAwROoKrumGLWsyK9kEv/LKPXD0LADLo:lZtUMcbAwUon/WsyK9f/uXoULo
- TLSH
  T11B7833C7CC159C0BD521F47E87A06EBB0D413C6BD68136839B62FDA0A8F7891DF68856
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Registry.dll
- Size 25KB
- SHA256 4f585d4dcb449fc1b0e002d7e850a059bf254769aee0fb83841f73064ec63014
- MD5 5408d183e7e2098ffa0290a7a5f9af49
- SHA1 5e8402903bd805ea136796032115b72f2d728c8a
- SHA512 2f3936808a257aeff0c1daabc274abca583e04395287c2a60778a4c01b5449c9364c6b42ef6a1588dab6823456b4f196ed22a7a911eb5cd65806a01da4d4c398
- SSDEEP 384:wUsbaKAjqsQZlJee0QwFJM5LPnnqutjZGmaZUjeVRVKY/raQWBQqLN9AYUVf:uBAoBwF2ZtN77j0KUeZBQo9AV
- TLSH
  T17AB25C8171D1D4B2D09F1579AB862F19E3EFAD603270E85211A67FCB33918A2D379B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Era V3.exe
- Size 201.1MB
- SHA256 c9eeaa76c621ef3ddfbb67629f003f2525cca716284019bf846b0e62a069ff6b
- MD5 36164c7bf465ac9e8e699fc7d5b59a07
- SHA1 0b0689ea3d78f189e93b71cd7f5104eab41a799c
- SHA512 37b28c3da011bdaa3a0cadf06def3c7ab659481ce631bd7c89198df73da32c69b20c1378f3f3ec84017d96515bacf82d6e2a9cf9e5fce00e8eea1db46e83bd0e
- SSDEEP 1572864:NPfm31RV7UxMlZE9keIhkYLc7N49dEK+5Gof9IP554PxLom+gsT6BwLFFagWLmIR:xoba28xLL9516bAM
- TLSH
  T1E2A87B03E29A41D9E06DD175974A9633FE71B8094B24B2DF2B9407522F77EE42B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral13
- Target
  LICENSES.chromium.html
- Size 14.4MB
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH
  T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  dxcompiler.dll
- Size 24.9MB
- SHA256 aca2fb078fe994aa3cb7773d5919c8822c94398f216371f214045ffca2a4320b
- MD5 2f5501f38f1a2f37ec178b9059d3bd55
- SHA1 f0092390a8a14d2d04a45101e64cafc0443fd7f8
- SHA512 7ed07ad76368ef627b357f1544e5425090665c33c1481332c746093404aac3ae8acde134342a8ee4d30472eb31176d06049e7abb8d4a44aa9ad93bd3375b20ab
- SSDEEP 196608:KINfcxXBXSsTP5HtTz2HF0guYYl8Cqe59luxQpB:KINfcxXhSsTPduubGa9lu0
- TLSH
  T1944729122246D49DF059C878C3678616CA6C34E73FA778EBC0B461252B7BEBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 e2e85d40ac197934302822be1f1202fa854e26797010dec6f8f743607ba1a390
- MD5 41e9050778ba83ba6de2eec71a625e6e
- SHA1 1669432043922f864702dd61cf30a3ad591be7d4
- SHA512 1b5117a79cb7a188bd848e2b4b3fba2f9fedadf227465a44f5e7d912dff48a697b0c58d2e7fc9a2004a4a64e26aed46a096aa4c3896a59a061414e5ffd5499b6
- SSDEEP 49152:q43V5jmDptM2VrfQQdFiO82PHb1SKj0vVr48vCkvjvvMHMnfDKmggnxu/zR7GI2U:qQ5sM4FiOLvbq59vjvvMHMnfDKmggnxS
- TLSH
  T1B9E5AE03F6D650DAD029D17197AB9313F631380A4F2056EF2A804A253FA7FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  locales/th.pak
- Size 1.2MB
- SHA256 45a573589f11c1694490913c00bbff65d57e232d33ca2270ac2e443207b971d2
- MD5 79b81841fde5ef8edcb46d2ba86dca09
- SHA1 7d9fe5a44d137dd4cecc6009d597f77587e84c7d
- SHA512 31641437d3c012ab0a88db26539731c7c60d141d10646c4b457691c0827f0a0459adf479579b52263e6d4c46728642cceeaf6ba59a2249ff76a4c7bd5c59d056
- SSDEEP 12288:lvJJLN9LyZYAhzYLz8AsShukJUseTPsO5eXffpbDFDS6Sd2N+Qj4B1qsl5URqE3D:9J0O5Ssf
- TLSH
  T114453BB37247DDD479441B5B262A7789672DAE693F73F8E00089215A73F071A8432EE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
- Size 11.7MB
- SHA256 e3df9ac4efa1a8407bab95beaa2adde6f7addb39312c37796d9f2c9d12441a0a
- MD5 1eb21fe71d38e4c109d078a538dac860
- SHA1 4039dd99d8b8e10d07e318c5eecc07ef4cfac740
- SHA512 e3274b609e9a1930b212da70b55b1cfef8ba7cab6b66fe7052415b977fc15efa3a804aa3acc259d8918b1da9e02a802506e0d42d3db8f326a12e41ae5ab90033
- SSDEEP 196608:SvvpkJAxXEouPQ20C/vgS6HlcVe4Ei4eGUae:SHXEoohZvgS6HlcVe4FgUae
- TLSH
  T192C63943F76291D8C06AC174835A6232FB71BC4D47307AEB5BD08B212F66BD09A3DB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/binaries/FortniteLauncher.exe
- Size 52KB
- SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
- MD5 aeaa6f47b71614437c0d47828da005ca
- SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
- SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60
- SSDEEP 768:XvoQcESFi3EadmMYDH8B85W2Fb9bCm/fOhgrv3B+o:QQ5AijdmMYDo85Wkb9bCm+Wbb
- TLSH
  T1CC3362D43AA89CDAEA10527C40FAD331253DB6E0865347576A30B7320F13BE17AD725E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/build/Release/dll_injector.node
- Size 121KB
- SHA256 dab11fce07f57a740ae7c9d58dec72433794eabf2d672c82d5d48795affba111
- MD5 d021187e242f1c4d789c6a8004e9f593
- SHA1 c93f9cbf02956f675a6c9d58e0226adeed6f8b45
- SHA512 4ab021d5bb96a37d2bb3041c9d3ace2afe6a9cdb11ca241ab26b4acea32efe954c8585959a6d0b16f24cd0d7bddb58b53e8fe3b8f673b04a2bc9ad47bf28b310
- SSDEEP 1536:gRZ4STUtKwik1O+tSYmKjhpSRagSNiJoxOlKw9cirW5KzhUsWUodw9dlLSCdXjGX:UlUHfrqG0RagAtgKw95CKiA1SYXj
- TLSH
  T160C36D0BB3B900BBE1778279C4530A46E772B8451A60AFEF03A406561F637D5DD3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  resources/workers/diskWriterWorker.js
- Size 8KB
- SHA256 61dec2a88c00909e9a41b4e8d26310c3667235c3cb6ef38c81845d4ac31452fd
- MD5 4a3d4ab4d552940217e3914e76813c79
- SHA1 28dc56d0fd2f5c1099568cbd84667370180b69d1
- SHA512 55388e3e7f03a6216d1a4f9d1ee07cbdb31cf587f930155375bd3a238d27ae769ea774db1c726cad016b1c7a2d088d04e81948e5ce0c83130d8d1d3b134f576a
- SSDEEP 192:L+YA68hxpz9BVRGhwzJVgQktNV/i25aou+DEv4GSbEyQBod1mnnhYvVfKhLCUbS6:yrNhjzihwzbghrTQlSo+c1/XP
- TLSH
  T1D102535A0AF62B29806332562E5B5413362EC1675618FE98FBCC83F46FC413C9DE17AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/workers/downloadWorker.js
- Size 920KB
- SHA256 40339feba98cfcbd4ec5531cac27c07c86515193b195da788d7b96ed7b2cd3e6
- MD5 0ad19db6b64cfeaf17947f4d255f3ebd
- SHA1 050ea0ae66bb828a4316e60cbf1f354de6d41292
- SHA512 098df16fde90462f4ebf4c43c727c97a73ba9e9dfca559f6e08c6e2b59c18736d1cdb47bda6530b1bf74067043a8d3195c8964836805453466baa268720d59c5
- SSDEEP 12288:5YtWXGdOnDK9IG4gVm72bICY6R27rlBtIzfRnxRDss:5YtWXGdOnDK9IG4gVm72kCY6R27rlMn
- TLSH
  T17D15F4891AF324129363B17E9F5F9402B134D003260CDE98BD5C97A55F899788BF6BEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32