Overview

overview

8

Static

static

5

InnerEvilLauncher.exe

windows10-2004-x64

8

InnerEvilLauncher.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

InnerEvilLauncher.exe

windows10-2004-x64

8

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

dxcompiler.dll

windows10-2004-x64

1

dxil.dll

windows10-2004-x64

1

dxil.dll

windows11-ltsc_2024-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...32.exe

windows10-2004-x64

3

resources/...32.exe

windows11-ltsc_2024-x64

3

resources/7za.exe

windows10-2004-x64

1

resources/7za.exe

windows11-ltsc_2024-x64

1

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

resources/.../7x.sh

ubuntu-18.04-amd64

3

resources/.../7x.sh

debian-9-armhf

3

resources/.../7x.sh

debian-9-mips

3

resources/.../7x.sh

debian-9-mipsel

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...rm/7za

debian-12-armhf

4

resources/...64/7za

ubuntu-18.04-amd64

Sharing

Copy URL Twitter E-mail

General

  • Target
    InnerEvil.zip
  • Size 140.2MB
  • Sample260903-mlvrks1vfv
  • SHA256 4c0b7b29e1e3cd11fbf969fa30f3121144875f925dc6e52bfea43a29b7754053
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionlinuxpersistencespywarestealer

Malware Config

Targets

    • Target
      InnerEvilLauncher.exe
    • Size 140.2MB
    • SHA256 6aa4af916102c759172c5e7df336640b10c79131b694974c1ce27396b9a872f9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistencespywarestealer

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/app-64.7z
    • Size 139.7MB
    • SHA256 45ec02791927561a329d4cb409f4a467a45c9970b755e064b003ea8bdd987fc2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      InnerEvilLauncher.exe
    • Size 224.2MB
    • SHA256 b367d47020fba010c2794c0cb90c5fc46b7909c28c9f4c3b88310ccae00bb161
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistencespywarestealer

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral9
    • Target
      LICENSES.chromium.html
    • Size 19.4MB
    • SHA256 5d545ce8065079f38a82472ab93bd62fcdf73cd319f0771ef51c45c7e243f1d4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral11
    • Target
      d3dcompiler_47.dll
    • Size 4.5MB
    • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      dxcompiler.dll
    • Size 24.5MB
    • SHA256 61acae29106bc2dc39dc68620e55e807ff16b681e4fafde3127a714253031a3e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      dxil.dll
    • Size 1.4MB
    • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14behavioral15
    • Target
      ffmpeg.dll
    • Size 2.9MB
    • SHA256 62bab2ef952838bac6943e25cc5757bc2ff8f7821cadaab139769bf8ec5275a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      libEGL.dll
    • Size 467KB
    • SHA256 ede2fbfc9229d176b4c4eaaf59b007a525f9460ac9114d32cd9ff57cfa7e764b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      libGLESv2.dll
    • Size 7.6MB
    • SHA256 f12e56fc7c33d6bd7d0112b8aa711d19b577d524e3aa1b39303e88c68a01133f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      resources/7za-ia32.exe
    • Size 773KB
    • SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      resources/7za.exe
    • Size 1.2MB
    • SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      resources/app.asar
    • Size 60KB
    • SHA256 a51f8ab9e799fa303b087589b7101f49168dec9ae8fb545425cc8d0eb899edc1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
    • Size 235B
    • SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26behavioral27behavioral28
    • Target
      resources/app.asar.unpacked/node_modules/7zip-bin/index.js
    • Size 500B
    • SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
    • Size 983KB
    • SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral31
    • Target
      resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
    • Size 1.1MB
    • SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

Visual Basic

1
T1059.005

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Query Registry

3
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
5/10

behavioral1

defense_evasiondiscoveryexecutionpersistencespywarestealer
Score
8/10

behavioral2

defense_evasiondiscoveryexecutionpersistencespywarestealer
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

defense_evasiondiscoveryexecutionpersistencespywarestealer
Score
8/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

discovery
Score
4/10

behavioral32

discovery
Score
3/10