General
- Target Launcher-Eighteyes.exe
- Size 77.7MB
- Sample260831-a53kbasfqe
- SHA256 92d7c95277a91da209e6145e388b48c0ed17b5f08bee61a44adb315d1cff8ee8
- MD5 2d2c114d883b73d50154bae7f16aab7f
- SHA1 7884f316cd76c52cd88209f3778cd39b11edb152
- SHA512 d3497065752d534ad0888dbfb2d1f001508f97fb5b57daa388579f9728105508dd2515f8e067f8eef5f5c0f019f7bb2cc80a7911a77c00e6e552da5a273623e3
- SSDEEP 1572864:BSnyecA5kXa4QTEidcGiURFtxkCzk2SztAM/HqlB7:BeyeFChQTEm/SpAh7
- TLSH T1470833565678E827CEDED63A00A2D03218DEDC821F40CCFE1B8BE6A1697D7C43B5D919
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Launcher-Eighteyes.exe
Resource
win10v2004-20260513-en
17 signatures
120 seconds
Malware Config
Targets
-
- Target Launcher-Eighteyes.exe
- Size 77.7MB
- SHA256 92d7c95277a91da209e6145e388b48c0ed17b5f08bee61a44adb315d1cff8ee8
- MD5 2d2c114d883b73d50154bae7f16aab7f
- SHA1 7884f316cd76c52cd88209f3778cd39b11edb152
- SHA512 d3497065752d534ad0888dbfb2d1f001508f97fb5b57daa388579f9728105508dd2515f8e067f8eef5f5c0f019f7bb2cc80a7911a77c00e6e552da5a273623e3
- SSDEEP 1572864:BSnyecA5kXa4QTEidcGiURFtxkCzk2SztAM/HqlB7:BeyeFChQTEm/SpAh7
- TLSH T1470833565678E827CEDED63A00A2D03218DEDC821F40CCFE1B8BE6A1697D7C43B5D919
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1