8472725064dacc78484375fce5876b76cb77a319fb104ddcb9180e8bce8d9335

Sharing

Copy URL Twitter E-mail

General

Target
FletcherSMP_LauncherV3.0.2-Setup-1.0.0 (1).exe
Size 110.7MB
Sample260812-vwb18a1fqa
SHA256 8472725064dacc78484375fce5876b76cb77a319fb104ddcb9180e8bce8d9335
MD5 a6fdee36d0f1e2d82f201830276689d6
SHA1 79b42dd2358cd9b34db66c6394a94d8cc40859b5
SHA512 ac9e7f6903dff3e35c14c13ba1bb56e319512b14d3b29c43a4cdb7b00b91da1559065d09534f79e215ac48cd3c836c25019d67efd7d203d00e8eac91a0043056
SSDEEP 3145728:dl4lEcnFJ1ivdz/gU3736zVq6w38N66gcCVz:YucnFJqdz4Ur6Jqns6lcYz
TLSH
T1CC4833CA0614E41FE592FFFE4CE0E2BD28FC6351BE1CC31F907995E994ACD862641929
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FletcherSMP_LauncherV3.0.2-Setup-1.0.0 (1).exe
- Size 110.7MB
- SHA256 8472725064dacc78484375fce5876b76cb77a319fb104ddcb9180e8bce8d9335
- MD5 a6fdee36d0f1e2d82f201830276689d6
- SHA1 79b42dd2358cd9b34db66c6394a94d8cc40859b5
- SHA512 ac9e7f6903dff3e35c14c13ba1bb56e319512b14d3b29c43a4cdb7b00b91da1559065d09534f79e215ac48cd3c836c25019d67efd7d203d00e8eac91a0043056
- SSDEEP 3145728:dl4lEcnFJ1ivdz/gU3736zVq6w38N66gcCVz:YucnFJqdz4Ur6Jqns6lcYz
- TLSH
  T1CC4833CA0614E41FE592FFFE4CE0E2BD28FC6351BE1CC31F907995E994ACD862641929
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  FletcherSMP_LauncherV3.0.2.exe
- Size 212.7MB
- SHA256 542ceb8fd1282a45f45dc0c2a8b3b0c53a2bc948be52e5566873a54b6fc05633
- MD5 b18a17962d37cada24600d7c0b7e56be
- SHA1 7770dd02a03a509d23a96bc32fb49661a88ebffb
- SHA512 cd9fa5efde5e750cb55a3a417fa9ce9ebcddc3ede4b495cec2f6dfa2299ac824c23cc5910fbedd5df461caf45f521ae3ac1ec081e043a953ebf88d2aac8302bb
- SSDEEP 1572864:lYOueq/jLLjV4Z1A3IddZPFR7oFoTBY1UIxCsGimyApMMPsTEVtccEAzdFkAEcBP:UjIoF4dJlzR
- TLSH
  T19CB88B03E29A41D9C05DD1755B5AA233FEB1B8054B24B2DF2BA447522F76EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral6
- Target
  LICENSES.chromium.html
- Size 18.6MB
- SHA256 c1bc6cfdd6c5844720e5e6332698a6131f5402e77abf1fdb9646740d38065a65
- MD5 68bebb0e4b93ed694e4493608a77f457
- SHA1 da90f6238eb91d6369a45f075b7c31a26624f8f2
- SHA512 cf8bd94f45ed137e383ebde6ffadec046609cf8c18e17d5017031a7ae9b3105c1883ebff1ac31d3389301608416c729c42d82d027c1782da1d96318b82623d5c
- SSDEEP 49152:nRWnjZ1pNUAwuTYp2bKvC6I3r8xsJQf8xFTneQdt+lHx37DoB:Y
- TLSH
  T16C17B56BBB49037316F242626B47A5CAF31EA13F375A1654309CC11C2B7B92483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dxcompiler.dll
- Size 24.5MB
- SHA256 db72abfc0de76ff1504e240da07c1dfd8646ce46aa30df9bf4fb2258161f97d1
- MD5 f7bd36d4e0f7c477c05b96a054baf68a
- SHA1 d268b3fdb13073a986eb80238aac252bdfb076fe
- SHA512 5d72972a99ee5a72124acbc38b98e95467be7cd0266ea9c82e828d7b0f3b129bc6767f78e6e255678ae55987a8714ab9a46279bce618e4ddab5c86b85dc3781e
- SSDEEP 393216:zUTn+V5ObvlrOM6ONrkCoXAroHeOKxM6e:Teb4eCVwM6e
- TLSH
  T113473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 ced08d56da30dc9671c088870f8cd0820fb5b43d568be5588d9934b883cce43a
- MD5 8d3a594549fb95fa1e35d77b5d7e2c7f
- SHA1 b14278e2a2f0c8dc3bb42b3438c7693098ab93cf
- SHA512 786c908e13f7042a168022442fc49882ed3e9660849c4cac919bb2aab11a68cbe06b70423c125ff90bed626a9c1ef110a54f0bae0fd000f7ea388b2802aaf2d0
- SSDEEP 49152:7lGCNdPwp1E6o/xi59rx2yrT3199aWLKIb07k6hlVv4NoJHDDGgwvm:7lFirE//w9N2yrTaHwNoJus
- TLSH
  T132E59E02F6D651DDD019C03497AF9213F631340A4F209AEB16909A263F6BFE87D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libEGL.dll
- Size 508KB
- SHA256 f158a8da0e8b6c56bcdac67ed95446df6f984ed192d895a5c8040a43e8343bef
- MD5 617e3f7f69a5c2ceaa6e18c6d7517039
- SHA1 ae1e2ed7d19551829770fdf4d452f7ce352d7fca
- SHA512 a81944fd41a9b645e7096fb880fa26fe696344739f8b640b0bfd17603e10233fb10324c6c42db53fcd072abf7c59a3ffe569256750298587901079f52d8f0b9d
- SSDEEP 12288:I162HbwE8+Tj5I9dWnQccIu+GwhugaD2:4221IKu+5OD2
- TLSH
  T1CCB48E15F3E94BACD07AC1348A438646DB7178921B65F9EF02E052352F3BBE45B3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 c3e413e81f52f64415481daf16232e18ae19caa6b0cf2768a02a0a51d3436b60
- MD5 9dc8277561d6df78fdfc0d66aa71730c
- SHA1 52ddd9022f5ad044d254a433f80e0c18ae5e5952
- SHA512 9e2b4cf6938ca730c49e5e24ec113b6142d2b7f5127b0c1bc42cc95b8ab1020d5fcb5f262616a520c1507e7f9f2e387edfadd4a85c2fc04e1cc3e02b37ff0ff1
- SSDEEP 98304:sSqq37sgK2EEDXCrfI8g++OGwBeAM4HdBG:FqQ74KDzTO5CGdBG
- TLSH
  T1A2867C03F68641D9C05DE2749B67A223FB34B8450724B7CF2AA457152F6AFE0AB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- TLSH
  T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  resources/app.asar.unpacked/node_modules/datavault-win/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- TLSH
  T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_arm64/koffi.node
- Size 1.5MB
- SHA256 4c730af0d6c84f2b88e22b80fb106b7af416deebe9a1c8e8336d6e4b1fce819f
- MD5 94a02766197dfdd1c61ce88969678428
- SHA1 3e9ddea7546153433a70a7c33fac8c5a509bbb41
- SHA512 9b43c54891d8b44a883586dc83bea7514c2881e3571794d3a843433ca0109427431ded4692f3c4b313a14a38daacb1def54402da8a071e71abef644ab46795f5
- SSDEEP 12288:6iqP4v1sQJvwUhxN23ooZLXSwLN/TSZqrI80ufwsVfmmRqvL7jxIknSJgd5sh0IC:1xv+QFpcYwrtTWl7jxIknSygh0t
- TLSH
  T1E665C952A21D4DB0D7E522B4AEB60A1796903C8BF3E04C58DD14E7092FC33B7F94799A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_ia32/koffi.node
- Size 1.4MB
- SHA256 7acaf95d9da7dd4e2c5823be5321dd6cda109c07c1079306c3216d1aa6688f8f
- MD5 22cee0f63e7925392fc5b501ef09e2d8
- SHA1 8be2c502a827100f6d821e8a6b6c6402d8765e38
- SHA512 0037a2a2e0a41e307103c3dac3f819f27b540a083245167162a67178cffca028ede1e0c9b66c302e13d42d4846ec340b1d26603cc977d7465c69e38c169e9a98
- SSDEEP 24576:dkbksiORbcZN+HxW6wuQEN4nHlNA8JZxE8TpJ6/zOu6:ds3c+RX6EypJ5u
- TLSH
  T14265D80AA61D5872C3F696B23077062B64A0390773E94C55EE18EB706BC33B3F575DA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/freebsd_x64/koffi.node
- Size 1.5MB
- SHA256 ef05047b3ec7fb73e74c96113f67bf878ad74a9e4eaef20ec3f83317460a2bbb
- MD5 c9205c1a77f125ca11accef171dc523b
- SHA1 327aad5223a49dcae6c92e3b563ae191cc8cdcb8
- SHA512 71df48625e32bbde942fb4205bffbbefdfaeb4b79551f15a49f21721034382651ea07fbf1926883f8ab59ff782abb751e0513b3abe7cd5900289fb0ebd918f18
- SSDEEP 24576:SXXdAHLip6jXSRpj5yKdkjivM9lWg6bqp:CZyXwj5peivM9lWg6W
- TLSH
  T1EE75CE46A3194AB0E3ED51703FF646276490788B33F89C59CE18DB502FC33BBA96D958
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_arm64/koffi.node
- Size 1.5MB
- SHA256 da394ea5d8f28cf8e90c6b1bbc3f35485adb24f36dc36265806967213c235a50
- MD5 5d5558b0c0610a5375177f8edb7d044e
- SHA1 f1f5e3189dfddfbbeca3cc35983d2910aab0c8f5
- SHA512 7f5a54e63952db226895312e17f165f9fbd12e92aad8de73c7c6ef639536244d6e465c9eaa1bcba49ccbb3d89850c6c97d38ad01a05fda92af9a991909e80a0b
- SSDEEP 12288:eUBzg2qCZqrI8mKdk2rQz8kWPC55ocHV2G9cMtYyOxwc0NtKemPS9a9cX8+b5NAX:ebrOKsH8cHV2GfROxwcIso8UU
- TLSH
  T1F5750B42721D46B4D3E6A63832B58E275CD47D4FB2D04C64EEA507482FC33B73E6A896
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_armhf/koffi.node
- Size 1.2MB
- SHA256 5ece8a66d2ec7eed61da4d294c834b40c7631868a0e1b9ce45649e9c4df81ce3
- MD5 a5a0f8952745d4c644af0fdc93b32a53
- SHA1 66414b9a1d1757015b923719b2c03b1b3a7d4b40
- SHA512 c676af51b65f2dee19b4d2f33120257bceacae2fc80d411d3a645ca7d5049346888abdeff0cf71da13b870ab788d378a7ed05e0848ddaa4275ae1cbc9076e993
- SSDEEP 12288:VUtzg28jMRGXtavob61Z7PUZkV8ModtGWVwfpW1RJMsaMGSugEhMh7skUZb55ulg:VUGdjMRCBb6rM5RUsgSXZBUZb5QlkJ
- TLSH
  T16D55F962625E2674C3F61A34713B96272CD03E4732E54CA8ED24B7248BC33B779B6D94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_ia32/koffi.node
- Size 1.5MB
- SHA256 f5d7732a3a9d890ce184855399907c85fd86f0ea8a2ed2fb846534059de1181f
- MD5 83fff7ebbac35d3cc4db72981350c9a3
- SHA1 4bf007bd38e1c805465acd997cb405f4da39cb8f
- SHA512 4b5ea7ed9c3b703d0e80e9bd0fb49aca02b01ec5f20f0ce11fb2e4708a6ab8ad65232c89d7da13f5a72c2bb50f76950394e1ab0367377efeb8a4c6cf4dd32514
- SSDEEP 12288:K6EebGI90zg2qi9MHxWEpwuN957dNnjlibdlnUP8FTAr3bu/ROI/J1JQ7KBmP/fK:K6hL9HxW6wuN957XhirRu7B/pP8Ydb
- TLSH
  T12A651D96A2594672E3F216B33276872724D03D0373E96C54ED98A7603BC33B37976CA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_loong64/koffi.node
- Size 1.4MB
- SHA256 31a7add40a525c65be33ee30a771f447b0b1d60ba83b3e502439ccf69a08b3df
- MD5 a690052d131f06b796b013bb8c4a6fc3
- SHA1 fdd926e4e0afad9c4120520e3267b51915e5bac4
- SHA512 01f65f33255497ab5aad56fcc0d29ef3ca5edb790cb94bd444f8ae23066a35eaeefd79f556ced07003f9b8cb4eb32614c447364b8629308472f4b332be5beb27
- SSDEEP 12288:VDmPYTzg2x6efVY6AB/GD388V3DEdeimM5nsw3GlPe8hm/Em:Fmgg9efVY2DdV3DEcxe8o
- TLSH
  T1CB65A40B6BD90DF0D3E5163421B607172394BE1732E09EB6DD5897002FC37AB3E55AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_riscv64d/koffi.node
- Size 1.2MB
- SHA256 26c7a6fd6962fef8ca5fdcd5a6956e9758a2d652822bd3ef4c9c04e4725c06d0
- MD5 dc9690b2303476fb5207999660911299
- SHA1 7d8affa230b9784f7abec1abaceb7c6ffaee07d1
- SHA512 48985fab13d165afa44fbebcee9bbb66c42d6423febf0cb7cccbc4f532ef2b8ad32077b6c7c180d1073a0c6f5833bd5805ba3f260008edfb266fed3ab6fb5072
- SSDEEP 12288:UpUzg26MvXeeeeCCCCChQuICsbGea8jtD4y+:UrbM/eeeeCCCCChQuxmD
- TLSH
  T1AF5592227A5D06B1CBFA1A74B1B60B1323D1BC1B75E11E149E3447906FC73B73E52AA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/linux_x64/koffi.node
- Size 1.5MB
- SHA256 ecc61aa265a56b99182c648e56a91e4c60bf3c7e542efaca93dfdb0452e03330
- MD5 4098ecbbde7fd95e02b2be55841aaf68
- SHA1 b89e85e6bd5e9fa35a643face65243680a3c9060
- SHA512 337a5da13b555a18d00390cbbd3d5e8b20f922b536f5bb0f5651d3585ca3e254500b06c82081beda60e518411bee64ae48ab52c015b44c5546115f70ceaa52ca
- SSDEEP 24576:fDhQaGzh1hSQLn/Ttcq+yFLyoWnoxUlkSVX:raakh1fLnBcq+yFKnoxUyS
- TLSH
  T10B75F306A31906B4E7FEA9702779CA2B24D2380772F48D1CEE299B502FD33772B5D954
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/musl_arm64/koffi.node
- Size 1.6MB
- SHA256 6cbff8fcc93c19874ffe68668ab806b933f1f1f98f2a18d399964c7bd81c939a
- MD5 e4c29350db6c2acd10b5699e630326df
- SHA1 c23f26332e839c6bc0a8482728fb8edcb13107ba
- SHA512 528b6f0ce88921d4cb52262ac7fcb4cf78d7215c642e4e09f432614031eaac1309f615dcde55342461f48f92e31ac18b1933a769e7c6f5dd908429fabf235605
- SSDEEP 12288:r/Dlzg22GiJ+YCoZqrI84yPU6UmjjE3rj0AvoPKwD2QazdbBwI5jYyxuohi7Ue5w:mm1NP9YAilog1
- TLSH
  T1F6751C50921D05B0DFF62A377AB58E2751D13D8BB2E84D54EE140708EBC33BB7A61B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/musl_x64/koffi.node
- Size 1.5MB
- SHA256 53ff9cc831cd1539dc3131e616603df42d6f17ff3a836a5e2d72adc0c99a6606
- MD5 541264da97f914f91657ac85d04112e0
- SHA1 40d7bf146c8230d422cc92d81174e496a231efd0
- SHA512 c61d70a9f1aea9eb9e576270cb5850ee0ddf17e57d214a8ca91c59a2836049a8945212c61771797b823245a637e30a43702c90029d473434eca6ad0d3260e356
- SSDEEP 12288:7qUgqM8Pzg2KiHekC4SsznGAZNdlZhSzluE1KkHZftF4C+8sJ7uKWT84Q20xdBCP:OUc8sjtGzh1hSQ8Br+L7uSHNB8/
- TLSH
  T19E65C8019A5945B8C3FE993426B58A1727A03D0373F81D68ED58AB502BC373B3F76E58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/openbsd_ia32/koffi.node
- Size 1.4MB
- SHA256 bc3b558da1ab1180dc3279b1349aac9ac569e92a8de30e28ca78199560aca8b0
- MD5 a74a4876e836c585a297e2e060a1dbf3
- SHA1 ace49beb1e497b4d44b9d334ce183861bf45d542
- SHA512 314e4d29eb9f7988607e53681ea2cfb37b1428cd6f6f0070437398ca4d8325351f39d5123f0b01c909be5a6f1d6e956e88a9ff30e7e5c8139da72cdced11cdb0
- SSDEEP 24576:azTU+tb8guJQDqvHxW6wu42+5zJ7CQ7V7h:GgMJ+Q2RX0
- TLSH
  T14D65F809961D5876D3F626B235B6162B2CA03D0773E84C96EE68EBB063C33737475D28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/openbsd_x64/koffi.node
- Size 1.5MB
- SHA256 be1f117f36f420608e34be5db430f9066e9f73407c339db31960aeb102e9e7a6
- MD5 4e33be5d1eb26e9878756c367692938d
- SHA1 9d7ad95ebb1d44b34bd74c222c8260e349bed8a0
- SHA512 0442018c1718ad01aa458e1e4807411402ae0747f89a118c05ef32b884b847df4d585853437fe039217eed7632b65f6287848ccdfa80c8a92cbbe5f160b0527e
- SSDEEP 12288:yP8TfC0zg2o/nFVMOuWuSIIMbzR6HDZkqdXSo3whrSVEj/45DQ4oRPmGdtYtr4zF:yP4UXnFaOvMp6jXSf2c4WmGXYtxG
- TLSH
  T1F575EF44C20D4AF4C3FDA174BAB545272E943CAB33E99C95DE185B402BC33772A6E91E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/koffi/build/koffi/win32_ia32/koffi.node
- Size 1002KB
- SHA256 af700e05e2578e3062917248fd5cb3a2cfdb209e2aeedf157b072534d0e884c7
- MD5 aba788b761a5ccca01bcbf1dabd1f38c
- SHA1 df9e25e7ef062548ac4eeabf36daa325c8d2c39e
- SHA512 d59409eba2412df4b3aed94d8d9077725d094287ad074ac1b47007a474ef824cb0fe5957f451bc20de8f8a26680bce06282dbfc3027a858f930bb5fc7a6dc88a
- SSDEEP 6144:dDZVpdphna1sItLyTI8hiihWokECR9gPOGPqv87B0NwlcfY2UpaRuHYffo6zn2U2:Z94ee4YmWo6WhPqv89uwl0rh2JbV
- TLSH
  T1FB258D217601C037E15804779CB8EAFA7668A8310BAC48C7BBDC1BFE55646F26739336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  $R0/Uninstall FletcherSMP_LauncherV3.0.2.exe
- Size 387KB
- SHA256 a62494367306b99d2f9e4c3ae605256a592eb9a4fb83becfdafa0e8fcb261925
- MD5 37b55477d8330b9b68ecb9f8251beab7
- SHA1 9ba13bd76a72a61f53b5cb3fa258a1bd257c4f5f
- SHA512 e3737021a5744e9e9ec59fe1741091444935ac8bcd3bfa9b8c410d3a39492559a44f633628c7e249c544c7b946e0122bd9e3e56912e827cd1ef5bfd91ae1d900
- SSDEEP 12288:AhXFHZ2xg4XCSujkraCXIlyXHG09SvSuC8TckRKK0:AhZOX/uTCYlOaSuC8AkMX
- TLSH
  T187848D2A1FA5DC4BC3661F7889F6F77A51B882903C1E8B47EE2244C8AD79F8C7C46511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral32