Overview

overview

8

Static

static

3

release-project.zip

windows11-ltsc_2024-x64

1

files/comp...89.002

windows11-ltsc_2024-x64

3

files/comp...98.dlm

windows11-ltsc_2024-x64

3

files/comp...42.dlm

windows11-ltsc_2024-x64

3

files/comp...8.data

windows11-ltsc_2024-x64

1

files/comp...93.dat

windows11-ltsc_2024-x64

1

files/comp...09.002

windows11-ltsc_2024-x64

3

files/comp...12.bin

windows11-ltsc_2024-x64

1

files/comp...0.data

windows11-ltsc_2024-x64

3

files/comp...71.bin

windows11-ltsc_2024-x64

3

files/comp...14.bin

windows11-ltsc_2024-x64

3

files/comp...28.dlm

windows11-ltsc_2024-x64

3

files/comp...34.002

windows11-ltsc_2024-x64

3

files/comp...9.data

windows11-ltsc_2024-x64

3

files/comp...6.sdat

windows11-ltsc_2024-x64

3

files/comp...19.000

windows11-ltsc_2024-x64

3

files/comp...87.dat

windows11-ltsc_2024-x64

3

files/comp...04.bin

windows11-ltsc_2024-x64

3

files/comp...5.data

windows11-ltsc_2024-x64

3

files/comp...7.data

windows11-ltsc_2024-x64

3

files/comp...74.000

windows11-ltsc_2024-x64

3

files/comp...96.bin

windows11-ltsc_2024-x64

3

files/comp...62.000

windows11-ltsc_2024-x64

3

files/comp...80.dll

windows11-ltsc_2024-x64

1

files/comp...48.dll

windows11-ltsc_2024-x64

1

files/comp...26.dat

windows11-ltsc_2024-x64

3

files/comp...25.dlm

windows11-ltsc_2024-x64

3

files/comp...57.dll

windows11-ltsc_2024-x64

1

files/comp...85.dlm

windows11-ltsc_2024-x64

3

files/comp...11.dll

windows11-ltsc_2024-x64

1

files/comp...26.dlm

windows11-ltsc_2024-x64

3

files/release-x64.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    release-project.zip
  • Size 156.2MB
  • Sample260910-k3y48a1cjg
  • SHA256 16076edaa11aa0dfbcc6fcd0534d8f823c980ba189dc4cf69e144295129ecf41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencespyware

Malware Config

Targets

    • Target
      release-project.zip
    • Size 156.2MB
    • SHA256 16076edaa11aa0dfbcc6fcd0534d8f823c980ba189dc4cf69e144295129ecf41
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      files/components/log_89.002
    • Size 956KB
    • SHA256 b5bac0f4ff5fd45670bdc60bc6ece57be246d429aef3a7f93d1dfcf62511084f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral2
    • Target
      files/components/log_98.dlm
    • Size 532KB
    • SHA256 7a79af5d3d3875ae25d837e452af02957134acdf5e73061d7f720ac372e482ae
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral3
    • Target
      files/components/main_42.dlm
    • Size 821KB
    • SHA256 ba758609382bc9ae9bec1775db0d3b5f2d97bf6375ff7dea8e86aa9b425e4efd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral4
    • Target
      files/components/main_68.data
    • Size 617KB
    • SHA256 0dd3f36a5b463df14524e8083c9f5a954ff86bc1b1531137f9ba8638fe556563
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      files/components/main_93.dat
    • Size 824KB
    • SHA256 50824a8c603bd7659e7faa34e01a5cb675861324dabe630b994c50803e7d3113
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      files/components/meta_109.002
    • Size 652KB
    • SHA256 5cef0b0486a06f1b87fe48920b6cf7ba59594c3fd44f513c21e2c9a7dcf540a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7
    • Target
      files/components/meta_112.bin
    • Size 625KB
    • SHA256 e464ad23fb31b6b92937f663ae23e532838f10ce61588c685122effeb365431b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      files/components/meta_70.data
    • Size 728KB
    • SHA256 71ae72ec12a26aff5e8d2456bf24610ad71defca6863f3e50369865247175d62
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral9
    • Target
      files/components/meta_71.bin
    • Size 806KB
    • SHA256 3716b732870144f7881ba904372fe55de22fe2d9b86cfe6dba9212fa1a9c7b5d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10
    • Target
      files/components/module_14.bin
    • Size 916KB
    • SHA256 e1f02418e7a9f7c4e1fafa231e9abdd3a44c7e9cef27a0d16b212a887d446f95
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11
    • Target
      files/components/module_28.dlm
    • Size 858KB
    • SHA256 e5d2b472f4cea326ff410c582b8c591d05fb0515b42cc98ec5350544db03b8c0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral12
    • Target
      files/components/module_34.002
    • Size 600KB
    • SHA256 be7989a3e9a61c4bdb09505d6e81914a1332e00e7303ddd4da230563132d8fd3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13
    • Target
      files/components/module_39.data
    • Size 1014KB
    • SHA256 5d9a4f8ba85b33dac22614acecd0670893a6636833bbae981cce8e225c1b145b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral14
    • Target
      files/components/node_116.sdat
    • Size 836KB
    • SHA256 aae83cc0048b45a0126c0cafa30e9491ba0cf9593b322de19c221a232a71a583
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15
    • Target
      files/components/node_19.000
    • Size 933KB
    • SHA256 c04897ebdd704889cb53175ce565086014273a673e45707caa23ab5fff32dba5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral16
    • Target
      files/components/node_87.dat
    • Size 633KB
    • SHA256 e153bc86aaef99002a2cf14d54e95cdb729bf0168388d66c1e08cf007b7bc0a2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17
    • Target
      files/components/output_104.bin
    • Size 988KB
    • SHA256 75b0ba7b24e0d15495481aad832f92507da8ca604514981dc2cb3bf7f61be838
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral18
    • Target
      files/components/output_15.data
    • Size 681KB
    • SHA256 732cc2243eb128b314a8c17f3b4388a6641ac49576312228872c9dcbab54cfe1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19
    • Target
      files/components/output_17.data
    • Size 1.0MB
    • SHA256 4d02f499682414b426f8f083813286d6f87e5f617c657dda2e1638c62b5b015c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral20
    • Target
      files/components/output_74.000
    • Size 968KB
    • SHA256 902f78b7a0059c154b877d087caf8418d883e8b18fd5d27d17d42049fc40ef70
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral21
    • Target
      files/components/output_96.bin
    • Size 625KB
    • SHA256 d8b4457c639d0e00c40cc24c0905e8e4a2d5b4ef326c1791d3c4e967000ba165
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral22
    • Target
      files/components/proj_62.000
    • Size 656KB
    • SHA256 1dc4a958430644f10e2fdd4934289235896c824617fcd85c5bf40c15cf70b4df
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23
    • Target
      files/components/proj_80.dll
    • Size 962KB
    • SHA256 a63c613c70e50330c7c5673a3bbbb17575b50814d1945fb72e02eed1f67df0f8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      files/components/record_48.dll
    • Size 613KB
    • SHA256 6ec6b3f9495c98b3ff010de651a696b31e6641447073cfdc681a1daa7aef1b5a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      files/components/resource_126.dat
    • Size 613KB
    • SHA256 77d5de531be2dac7462fe4c3f6d4a95eee6519b7504891884b9b308795b74766
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral26
    • Target
      files/components/resource_25.dlm
    • Size 533KB
    • SHA256 72ab8e861514a478d7f648a0db08b6f25df5eaecc624571fe8cf3db1bfda5f32
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral27
    • Target
      files/components/resource_57.dll
    • Size 864KB
    • SHA256 a486e8e86baba7c075fab2ac40284a1d87b5ebd2e17f3b8725056c91736324e3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      files/components/resource_85.dlm
    • Size 600KB
    • SHA256 f7bf46c296e6b4f316b9a2a34ce2ad708d97229f1ad4f12d3c89ecfacc627e25
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral29
    • Target
      files/components/sample_11.dll
    • Size 671KB
    • SHA256 d7c1058d31a75d02696711170b89333a8af3aa69d230f899e08963652844dc4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30
    • Target
      files/components/sample_26.dlm
    • Size 824KB
    • SHA256 df378e8e4fd4e2c34662025a3251088b784fc1286ca8358382826a997778ad48
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral31
    • Target
      files/release-x64.exe
    • Size 94.9MB
    • SHA256 a6a8a258d64c6f5fe98a666e3f52e92d17a36ccf9e2789f86a9743fef92fa095
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistencespyware

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Indirect Command Execution

      Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

      defense_evasion

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Drops file in System32 directory

    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indirect Command Execution

1
T1202

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

2
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

execution
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

execution
Score
3/10

behavioral8

Score
1/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

Score
1/10

behavioral29

execution
Score
3/10

behavioral30

Score
1/10

behavioral31

execution
Score
3/10

behavioral32

defense_evasiondiscoveryexecutionpersistencespyware
Score
8/10