General
- Target PineconeMC-Windows-MSVC-Setup-11.0.3 (1).exe
- Size 22.7MB
- Sample260827-zb4mys1ane
- SHA256 6db876d7d75ea53a61c45222f21097716dff3856d6947be637178b93c43d39fd
Malware Config
Targets
-
- Target PineconeMC-Windows-MSVC-Setup-11.0.3 (1).exe
- Size 22.7MB
- SHA256 6db876d7d75ea53a61c45222f21097716dff3856d6947be637178b93c43d39fd
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/NScurl.dll
- Size 6.0MB
- SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
Score3/10 -
- Target Qt6Core.dll
- Size 9.8MB
- SHA256 b98eea394a95563879b614dbd4432ce074b0fceeb154c3bae252f4e7a9376a40
Score1/10 -
- Target Qt6Gui.dll
- Size 9.1MB
- SHA256 28ca8b9e7d3d1c4e3cfafd6fe63877a05cf10202a240134a11f98384f01c9e37
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Network.dll
- Size 1.7MB
- SHA256 905e1ce3947fadaad566b6deffe345daf7f6efbc57207ea7fcdbfa77669e3de6
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6NetworkAuth.dll
- Size 285KB
- SHA256 2b2cee4bf6cd28c7c65cadc21089902062ac8c76b74340c7c205e2b5db79a4cd
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6OpenGL.dll
- Size 1.9MB
- SHA256 a41b71127d07924ddda67e787e8765ebf60f217817199f1becdd63f3db88847e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Svg.dll
- Size 617KB
- SHA256 982a589e52680d7b525da0031eba783d3bbd77e6611cdea5cd276a2b9213f4c9
Score1/10 -
- Target Qt6Widgets.dll
- Size 6.3MB
- SHA256 f383fb6b3f6996efe23327ff607e7298fc47ee76e8b8ef8a65f8d2e0a91707e4
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Xml.dll
- Size 156KB
- SHA256 c9d4c5c5dbf8d9ef3264f27c67bbaa0cd1aac98bee2f258b4a0a19664e9f18e5
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target archive.dll
- Size 716KB
- SHA256 985fd3bcb1fcee11834337e63dc7b0e7a100b69cde7a63b559d8fa64757de2f5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bz2.dll
- Size 75KB
- SHA256 caecef5737af3f393a305e7fcbf1109e064ca1517cae8fc1c9f31860827ea2e3
Score1/10