General
- Target ecore-release.zip
- Size 136.2MB
- Sample260820-v7cf5avzbt
- SHA256 c92295764b7d8a0c66d0e83c6d8d214b9b42ee3a6935d456b7b019d51cca61b3
Malware Config
Targets
-
- Target files/bin/lib_69.dll
- Size 711KB
- SHA256 75dc788148afc632f797d2ced177dbe70a314d9beccd7844c11a0b5806dcbe78
Score1/10 -
- Target files/bin/meta_21.dll
- Size 713KB
- SHA256 23a0d32fc049b3bbeffe98135138b10530cdd4e0515d82bc47a95935c091f266
Score1/10 -
- Target files/bin/meta_49.dll
- Size 611KB
- SHA256 bec1d9ee0bf49fa8dd455708807a16c34220bb925072a5fd916f02061a544fc4
Score1/10 -
- Target files/bin/node_7.dll
- Size 752KB
- SHA256 51d914613845712a7fe64cb3510afff1f2efcc0dfd3a2d8e45316830e6bc7a88
Score1/10 -
- Target files/bin/output_20.dll
- Size 551KB
- SHA256 da22d081554466b5ff30085046763beb2581b660ba39faba58e7638ba3d1179d
Score1/10 -
- Target files/bin/settings_39.dll
- Size 737KB
- SHA256 498ca76b97cb78bc3c6bc1aca576ca80175c1ac88c72bfbd3023d4129bd4110f
Score1/10 -
- Target files/bin/source_84.dll
- Size 699KB
- SHA256 1dd7e5874c4e56ab515bdab67c1b47426672d6226daea6736f0eba2f3fe655cb
Score1/10 -
- Target files/bin/struct_79.dll
- Size 618KB
- SHA256 8fa3666255a2f82fa9393390c4e6f3a29f0a4829b54f01dc57370bddaf186128
Score1/10 -
- Target files/bin/test_11.dll
- Size 792KB
- SHA256 982d1623de0db2170658f30e67154d712bda644a525762019c878678c3bbc001
Score1/10 -
- Target files/bin/test_115.dll
- Size 618KB
- SHA256 fb4678fe17d5a24104824102461d7635a0d88a810bad8418becaebeaeb6ff7dc
Score1/10 -
- Target files/launcher-x64.exe
- Size 97.8MB
- SHA256 05c02d754b086d3368db6ebd1b5c1c9353ff14d21cd595e902131e180c322e4e
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Adds Run key to start application
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target HelpSysX64.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Adds Run key to start application
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
Score1/10 -
- Target libEGL.dll
- Size 468KB
- SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
Score1/10 -
- Target resources/app/main.js
- Size 561B
- SHA256 f8c11459ada5366fac6ae3863966c1c0c78d22ad04b0cef37018f80ecc0831e1
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.1MB
- SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
Score1/10 -
- Target vulkan-1.dll
- Size 932KB
- SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Rundll32
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1