Overview

overview

10

Static

static

3

Jan_0.8.4_...up.exe

windows10-2004-x64

10

Jan_0.8.4_...up.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

Jan.exe

windows10-2004-x64

6

Jan.exe

windows11-ltsc_2024-x64

6

bun.exe

windows10-2004-x64

1

bun.exe

windows11-ltsc_2024-x64

1

resources/...li.exe

windows10-2004-x64

1

resources/...li.exe

windows11-ltsc_2024-x64

1

uv.exe

windows10-2004-x64

1

uv.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Jan_0.8.4_x64-setup.exe
  • Size 55.1MB
  • Sample260824-rr4znavwcv
  • SHA256 59f2712ff579208c7e50df1d4408675418ca576421998549f787879372ec50b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutiontrojan

Malware Config

Targets

    • Target
      Jan_0.8.4_x64-setup.exe
    • Size 55.1MB
    • SHA256 59f2712ff579208c7e50df1d4408675418ca576421998549f787879372ec50b1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutiontrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 15KB
    • SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsis_tauri_utils.dll
    • Size 33KB
    • SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      Jan.exe
    • Size 46.5MB
    • SHA256 0701936ffbae9de15b5790a066cd9576e43e27d72554575a3407971373aaf15e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryexecutiontrojan

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral13behavioral14
    • Target
      bun.exe
    • Size 93.9MB
    • SHA256 0187f68d843f825a72ada4a7eca60db896ed753759a7f8252edcd31ac1bf1b9c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      resources/bin/jan-cli.exe
    • Size 4.8MB
    • SHA256 b3a4b6ab09dac5ac9dfbd932a05fbe523c7a5870f9bfdda8368a5498414d3c64
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      uv.exe
    • Size 72.7MB
    • SHA256 19f0d8a477bf5f05f8b77cbae66b074bc326c7fa73bc947fe78a18c28a411a66
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20

MITRE ATT&CK Enterprise v16

Tasks