dc0586ea15e47a4f5c2cd2a6863a52e552bf6e9a85d5949da0e85abaf205e832

Sharing

Copy URL Twitter E-mail

General

Target
soda-beta-setup.exe
Size 122.6MB
Sample260813-b4e83axybv
SHA256 dc0586ea15e47a4f5c2cd2a6863a52e552bf6e9a85d5949da0e85abaf205e832
MD5 8fdfd4eee3883553069b1144136f280b
SHA1 db35e6b3a46eac433a2dd7ca3f0a2b1ceca85993
SHA512 40ccaa38056ae5a8f22d9d92d14bec03bf00078eb0b2665b20913f77cbfe0f39e5437be9300201ad1982eaab9d3ddfb7c864131483c679649e59cef02184b451
SSDEEP 1572864:mL3nKAXPDNsD9gbPfrQt+BiyNioE0fPtfGXy/+mxlsNdgi+RyZN1lJGaDw8LUr2w:mLYD9MQ8R5GXyuNqivPWaPL02UWuGcIa
TLSH
T1F258334EF750C237F80B593D8060CCD65ACAAF02A37C980FD7BA66206639617F6D4799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  soda-beta-setup.exe
- Size 122.6MB
- SHA256 dc0586ea15e47a4f5c2cd2a6863a52e552bf6e9a85d5949da0e85abaf205e832
- MD5 8fdfd4eee3883553069b1144136f280b
- SHA1 db35e6b3a46eac433a2dd7ca3f0a2b1ceca85993
- SHA512 40ccaa38056ae5a8f22d9d92d14bec03bf00078eb0b2665b20913f77cbfe0f39e5437be9300201ad1982eaab9d3ddfb7c864131483c679649e59cef02184b451
- SSDEEP 1572864:mL3nKAXPDNsD9gbPfrQt+BiyNioE0fPtfGXy/+mxlsNdgi+RyZN1lJGaDw8LUr2w:mLYD9MQ8R5GXyuNqivPWaPL02UWuGcIa
- TLSH
  T1F258334EF750C237F80B593D8060CCD65ACAAF02A37C980FD7BA66206639617F6D4799
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 14.6MB
- SHA256 6965e1b04dc81a012981508299e28542abff2bc7f418071c264f0b53e0c63f34
- MD5 3575333bc14b9a3c05160d72de394b00
- SHA1 159b59188618949fc7f646a381aad69753ae500e
- SHA512 d5f7bfa24bed869758e68ad62316dea7c74aad9873fc25a40f99b9216fe4d6ea6207269940f4c210ae0abc46116558ce1f95b78b1f857040db3d84d5b607fdc0
- SSDEEP 24576:f8Bd/jZ6JocjZ6X1jZ6QCjK6D0HwRiuTumfUKjr6ZjK6yjr6mjK6ajK6XjK6QjRv:f8KOe8rn8mVRx2
- TLSH
  T177F6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  dxcompiler.dll
- Size 24.7MB
- SHA256 6bf9d1e2befc53a95b7b7c374def814af0e1a21ddeb617779397e3e6ccd3b497
- MD5 26f722f1a39868aa64c84cb8c95de32e
- SHA1 6a2338a2fb69f68f24d0cf0b0d059d4c4a1831ca
- SHA512 538a189d7ca798f593c98cc97f5ba6ea70affb6d97ef63280b74835e34f1366027175cbc655f389a878735b1e36ea353eb8252a032414988d8b5f6c49adc14a7
- SSDEEP 196608:9VdpoNiKCpTtYPnCgrQTsB7iihDEsE/oVJ8P9WrNuU:9Vfo5CRtunpM6hD+/mu8AU
- TLSH
  T1394719122646D49DF059C878C3678626CA6C34E73FA778EBC0B461252B7BEBC1B39135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxil.dll
- Size 1.4MB
- SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
- MD5 360c2ec3a4114840498e4b0f45820395
- SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
- SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
- SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
- TLSH
  T185657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 67f37568031d61040ae13022a8ec933f7d4ca7faecbb71a701f0b36489c5a330
- MD5 0fb676579041ccb4f41d16bae48d2a14
- SHA1 16b6108686d2d5bc594c4cb133b448cbc3422169
- SHA512 8070e4966efcbf63eeef7ed7ac793a3efa0b8528ebdbbd6a3ad7ead2a5a8d188de44f72d9ff159230eef69f2b9b9926ff19ec214e4ba19d918e346ca7634064c
- SSDEEP 49152:YgV9bgOhaK1hjRfxschoa12wLqS51Blxo7l+ynjVmn7n8IK+ZJgQdhwlnwZGM6US:YkZsWjRffhyko7l+ynjVmn7n8IK+ZJgB
- TLSH
  T1B3E5AD07F6D6109DD029C070979F9213F671344A8B205AEF26D04A243FABFD86E7E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libEGL.dll
- Size 493KB
- SHA256 4e33a8b0632cdab12c0fab456a7d76c3c608fc9940746acd158effc493ba49c6
- MD5 bcc6a16c2b838e7ca9a2106cdec7ce9e
- SHA1 a8de5d7bc68b830c1d3c9b98a600e2b32c2438b6
- SHA512 0675e1c467651211e548a0fc35e093f6b8c89d695f06139ae84cfa2474bef07a87577b12659db53dbbaa753e0248b18ccc42664c8f3b9e9606d8f29b112c76ff
- SSDEEP 6144:PRrffvhM0pquMRXqJln2dYtfg4/9L6cOMCdlZ8zVAVf1q:PR7BMequ8q6dr4/9L6cOMCGpA
- TLSH
  T16FB48D15B3D845A9E06AC1388A534642DB76B8460B65FADF03E093792F3BFE45B3E314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 1a606ebb09bc8bcb64edefffe3fccecf720b557b9f23ba2aa4331b58106d9991
- MD5 93d57cd8a4458157c971d2c5083ce9f3
- SHA1 06205ad0ee2c4287160d2194b1059348c8b61e17
- SHA512 fec6c62e743efbe01b80776b1c328d4bb017bf4aa780eab5fb34005cab4d6cd818b2a61e4674aa9f734d3e818850292d3b17cc258712c95e6847c5d17e81ed6c
- SSDEEP 98304:nH+XoqwfpEvsQFzykXZYrOlyLX7SC4Ic417:neY7aPqOiD4Ij
- TLSH
  T196867C03F29A80D9D04DE274875B9227FA34B8850734B6CF279457252F67BE0AB7EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources/app.asar.unpacked/node_modules/@tailwindcss/oxide/node_modules/@tailwindcss/oxide-win32-x64-msvc/tailwindcss-oxide.win32-x64-msvc.node
- Size 3.1MB
- SHA256 d0aa887d95f0b8f2d58ee4cbb1f297d013bc6d11a77cfa50c4fa706c20840055
- MD5 16cfd372b91e6c1cc9c83a7ca763fa4b
- SHA1 4fefced6299f88b75e053edf8571447f27694fe2
- SHA512 2f43db34f42f94aec195de6e65c2fb400e09eae11f8fc50baff735314c7f6b6fb36936c7e8e3c97f8a65930bd4384743d567d77d9dca310d96db1e4ed566c818
- SSDEEP 49152:GtWwUumRGip6JyasB/ZNbFWOuEQDS0fEjnjpx/kA:3hZNFzlcwNkA
- TLSH
  T169E53A12BE9799ADC59AC874870B4A631A21B4CB0B36B9FF41C441393F69BF11B3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/app.asar.unpacked/node_modules/lightningcss/node_modules/lightningcss-win32-x64-msvc/lightningcss.win32-x64-msvc.node
- Size 9.1MB
- SHA256 83e7e838ef1bbf5454c651103574fec31a1cec0b453b999d1173365cbc6c7841
- MD5 d347b8e5dd6154cfd2886ffb03879752
- SHA1 19e0e82ac44d4ecc76e555421b7d6f5a0291bca9
- SHA512 b281b64bd032db64ab37141bba6e7e3c7b4799efcea1bfdd2283e2b52b85208f08c1c6dd6eab02d7ec9dd6ad64bc5c6959abb55e123e51f6113e89c3df3ccb7c
- SSDEEP 98304:jLL2MeOL9AEwjmeSPmeAmz0OUEr/jDaGPqeAkeZ/ud/p:KXYwCekGWapkrp
- TLSH
  T120A62A06E2B391E9C46DC47193576233FA317C8A8635BAEB4BD04B322F65F906A3D705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/dist/index.js
- Size 5KB
- SHA256 e3d73946a486b90dc7d304f980458ba4fd49bbc32551c2b40c493faaffee4a55
- MD5 7b45fc89d0b2cbf17961086c88aea98f
- SHA1 b19abbfb128c0f47c782a2935ff95006957e73b9
- SHA512 66af5bb55e364ff45f5b50fa7ba2e2fcf2bb4ce476b939be42a1f02b1c6fd48cc1189ee2e02b86671e0a5a0a445d8613004b88e6e2f280a37d55f51504fb9649
- SSDEEP 96:KEWFYlAoZw5wGJ89xcSrZXglRBVfPKa9idbYmeXCxDerfi1+p:KI9kdAcSrZXKJfridbYmVxDIi6
- TLSH
  T174B1DF5679C22998723367C80729811110776A276CD8FF96B43C4F68CF8F49D20BA7BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/dist/prebuild-test-noop.js
- Size 120B
- SHA256 9a7b050e26b0ee0076ebebe7b44e779d1b4b90d50331550316b47ba1d82b8cfc
- MD5 5c8e9bce873f720d31f6c6ef53a5360e
- SHA1 5bfcf7d8f8ea1c85664a1bef83da9ede191e121c
- SHA512 eeb0c03b7dccdba5a802d70cb7d41dd823dbb4f715e4303bab886a9ffbdf5903c266bd3d881d7537463f072506a6e6ff514b9240e30e3be5dadbe38cc713ab09
- TLSH
  T120B022FF88B3088C3F800EEB00A802C2C032C2F0E8820002C00300B8803A822223AE02
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-arm64/node.napi.node
- Size 69KB
- SHA256 f347ff7c1cdb54a22575bf1d1073430b8709462a4a5261b44a30b5bdcf714ead
- MD5 171ba32d76ce09d4d5888972a647769a
- SHA1 68e4998d42cec40164ffa642ffd1f5f1f929c90e
- SHA512 6fb5d16cd8e68f3fc43b96ff824f94bdd4f9c1d3938b826c71c07ba17fd03365d2620d8695972243aef48d9966495c0c040955c9eba19e648c564947ea70443c
- SSDEEP 768:fYsv30fxS5RZhJR5BpxZhJR5BpxZhJR5BpxZhJR5Bpxs0ckMU8Es0ckMU8Es0ckf:gsvKecxpehV5SysF0
- TLSH
  T19163F60EF224D97DC4D4C432EA8BD25221B1F078EA70163F7E84D77A2CCA66C497AE55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-x64/node.napi.node
- Size 69KB
- SHA256 f347ff7c1cdb54a22575bf1d1073430b8709462a4a5261b44a30b5bdcf714ead
- MD5 171ba32d76ce09d4d5888972a647769a
- SHA1 68e4998d42cec40164ffa642ffd1f5f1f929c90e
- SHA512 6fb5d16cd8e68f3fc43b96ff824f94bdd4f9c1d3938b826c71c07ba17fd03365d2620d8695972243aef48d9966495c0c040955c9eba19e648c564947ea70443c
- SSDEEP 768:fYsv30fxS5RZhJR5BpxZhJR5BpxZhJR5BpxZhJR5Bpxs0ckMU8Es0ckMU8Es0ckf:gsvKecxpehV5SysF0
- TLSH
  T19163F60EF224D97DC4D4C432EA8BD25221B1F078EA70163F7E84D77A2CCA66C497AE55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/win32-x64/node.napi.node
- Size 164KB
- SHA256 a4e18d5896c5889635efe31c6f1a0ce8ccafeabe9521e0f92c46a5861e8c290b
- MD5 629497ab98678c5d6f9af76ec3c7a867
- SHA1 3b56d0c4b787a838972d9a304acdf1d5f2b49f00
- SHA512 6d2003903cead41889902ff46ec282503bc234f99c3fbd8124b3e3cb1b1e63bf27e195fe9feb32086a82b6c83fa4e1aab309f8b76dcbb41487c8c987d25a351e
- SSDEEP 3072:S1M26BVoepFkqPPZ3i+wqOmSrRpO+QegC2OAF2+:yqoepuqPB3i+AmS9pss+
- TLSH
  T18AF36D17B3A504B7E5738238C9639A46F772B4110760ABEF07A0837A5F27790AD3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32