Overview

overview

7

Static

static

3

Notion Set....3.exe

windows10-2004-x64

7

Notion Set....3.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

locales/zh-TW.pak

windows10-2004-x64

3

locales/zh-TW.pak

windows11-ltsc_2024-x64

3

resources.pak

windows10-2004-x64

3

resources.pak

windows11-ltsc_2024-x64

3

resources/...on.png

windows10-2004-x64

1

resources/...on.png

windows11-ltsc_2024-x64

1

resources/...te.yml

windows10-2004-x64

3

resources/...te.yml

windows11-ltsc_2024-x64

3

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

resources/...ar.dll

windows10-2004-x64

1

resources/...ar.dll

windows11-ltsc_2024-x64

1

resources/...ls.dll

windows10-2004-x64

1

resources/...ls.dll

windows11-ltsc_2024-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...fs.dll

windows10-2004-x64

1

resources/...fs.dll

windows11-ltsc_2024-x64

1

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Notion Setup 7.31.3.exe
  • Size 101.5MB
  • Sample260827-ss54saxblf
  • SHA256 589ddabe7fdf162ee1ef3f59005929e31b96159b553fd5557af3c2dd208f2b09
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target
      Notion Setup 7.31.3.exe
    • Size 101.5MB
    • SHA256 589ddabe7fdf162ee1ef3f59005929e31b96159b553fd5557af3c2dd208f2b09
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistencespywarestealer

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/app-64.7z
    • Size 101.0MB
    • SHA256 d74b3ea6f93ad0af35c4b90d29ceb390f81327bf87b1a13a41d2649d08abaaf0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      locales/zh-TW.pak
    • Size 556KB
    • SHA256 8e831ed21bd21ce3610dc4b658aa337229c83dd6d7cef336923d69779d0365b1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      resources.pak
    • Size 6.6MB
    • SHA256 5585dc0e39e6efe9ee79979c8d50938633bf72e329848ca79ca07998d4d8c949
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      resources/aboutIcon.png
    • Size 1KB
    • SHA256 3bdf39f14da6dcbcd836ef6b343f3363e7c1bb841df11e4f4339acdba0ea3cf2
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      resources/app-update.yml
    • Size 157B
    • SHA256 b85c3562f1972cc6c8d5622200f37b07b9b8b80a9faf63103b2554eb5d6f8524
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      resources/app.asar
    • Size 9.3MB
    • SHA256 c41ea518e859ade535da11d78f9ec73a36252922bb9e7379438fb51291526448
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      resources/app.asar.unpacked/node_modules/@jasonscheirer/native-progress-bar/build/Release/progress_bar.node
    • Size 457KB
    • SHA256 4236701618c5a614e2de856ebe2cc90aa88f9fa62bfde402a79317d3649f66ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/@notionhq/desktop-native/build/Release/win_utils.node
    • Size 641KB
    • SHA256 8b833e3c469daa546a63cc4a778392910cbca534ef9ef5c5bc551c098df294ae
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
    • Size 1.9MB
    • SHA256 7a029b2251ee9f1532ea5e8750bbfe6dd8cad8cd78854f02458c640c35c632e6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      resources/app.asar.unpacked/node_modules/cf-prefs/build/Release/cf-prefs.node
    • Size 116KB
    • SHA256 018fa474be089464b84ede913fbdd0221ee31ba37620c2d9c620d8e937fa61fc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      resources/elevate.exe
    • Size 120KB
    • SHA256 6062b1f3bb41677b623f05f632fed43c740300af415812dcfad7a1dbc6f299d0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discoverypersistencespywarestealer
Score
7/10

behavioral2

discoverypersistencespywarestealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10