a998cc60a763c25f662454133c76d6ab93b6578a526df0720e99f33fcef7ce8f

Sharing

Copy URL Twitter E-mail

General

Target
StrataWX_Setup_SkyBound.exe
Size 184.5MB
Sample260928-xfd7rastes
SHA256 a998cc60a763c25f662454133c76d6ab93b6578a526df0720e99f33fcef7ce8f
MD5 72ec68cc21025138f0922a2bd02c10e7
SHA1 d57f07df4712dfbcdcb433ff0675ffda4367ddda
SHA512 31ca27a7923aebfce0c5751a0b2d204c54db24681a9089f4dd3b3b710aa2c3f153dc238ba2f7a3b4976ca0d62f327bd2edf6a029df9665e9825f38d1dead33bb
SSDEEP 3145728:UcUKydTzaD56m0/RVWKu9zpi9PvYANM3a8XjUeQr2uRWc2wVsNsfr+e:k66mSOS9PwANM3H6HWcyefr+e
TLSH
T11698332E7137C89ADC7EA0F932C7FA24A679517E5D2BCD830208D252F5C31A53A25973
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  StrataWX_Setup_SkyBound.exe
- Size 184.5MB
- SHA256 a998cc60a763c25f662454133c76d6ab93b6578a526df0720e99f33fcef7ce8f
- MD5 72ec68cc21025138f0922a2bd02c10e7
- SHA1 d57f07df4712dfbcdcb433ff0675ffda4367ddda
- SHA512 31ca27a7923aebfce0c5751a0b2d204c54db24681a9089f4dd3b3b710aa2c3f153dc238ba2f7a3b4976ca0d62f327bd2edf6a029df9665e9825f38d1dead33bb
- SSDEEP 3145728:UcUKydTzaD56m0/RVWKu9zpi9PvYANM3a8XjUeQr2uRWc2wVsNsfr+e:k66mSOS9PwANM3H6HWcyefr+e
- TLSH
  T11698332E7137C89ADC7EA0F932C7FA24A679517E5D2BCD830208D252F5C31A53A25973
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  StrataWx Setup.exe
- Size 180.4MB
- SHA256 2e05fcd32ae46c67541f1558940fd7d98aa9c1d99ac238a65d12538e26f293bd
- MD5 d400ca3798d554b4aa84a580bc3e7c73
- SHA1 80f68b477b20ddbe7062e72dc94b572324aa48b9
- SHA512 6c014d9d003f7cc7defcd6a64fc1e42383c49379bf389cbcdbc90bff51e9779e0cda95989d782bce6fea86c393ee992207339220d10321ecbe5428fac5f3cd10
- SSDEEP 1572864:WH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qt:jsok+hK7V
- TLSH
  T1C9988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  resources/app.asar
- Size 159KB
- SHA256 ed9cffbbcd06ae356eb9ca37dceac4ec9d53a4650b6b267b918ca0231de7d38a
- MD5 24f66aea723235ff76c8936807725267
- SHA1 52f3b07af0f85cb86f5cd13eb0b0ebbbff85a3f4
- SHA512 bc30607f5bf04614a9a2fb070e7910b6fceb8d38fb8a0831ab0dd19983248895671ff78e9565266ef5c6bad0033927dedd275534bfa0ad46b4969ea1bcb4e071
- SSDEEP 1536:bz8XGKDQamuMdPvG5TMbNLbPDvonU6rCP8GuEyWTgNPOmuMyDhWgE9h0Zra0mmr3:P8XGe21kMbNvDonU6swh0ZeIV/SMt
- TLSH
  T178F36C0327802335197243B9971F62A9F72B8027531351A4B9EE82587F331A9977FEDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
- MD5 edaeffe92dbfd973958c9d2267201b32
- SHA1 ae43e814d3eea2ff27bb414c9e26ecb1b5c0341f
- SHA512 d0e58cf4bc9db25982d726f1ba65924bcef8fa405f06f6abf0ab80177d691805ff228039c5a85c3a8029e4422fd50c3d8e84bc6528771092c79e3d5229f43281
- SSDEEP 24576:2o9dQj6p6j6j1WZswRiXj3mfI/6k6mjK64jK6gjK6e6cjK6feGjl8LpH:BWVeG2
- TLSH
  T1E896A52F7B48037306C642A26B8B65CAF21F903F3B561654345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12 behavioral13
- Target
  StrataWx.exe
- Size 180.4MB
- SHA256 53418ca45bba9a9b5b7cadd4cd4b44cf89574ffa6b389d83356a83b0bf5c8101
- MD5 7d4d330627edf1c40ad200b56b4602d1
- SHA1 2c499b847440233f6d4b42cd1bda656e09322bfb
- SHA512 5c9869c511fe9d1fe2a0d6b4f3738a93301cc952f3acd1019e59653976ab6492108b164e17ef184f1939c651deacedfc9cd65a4499624ae4d71c5b03fde2b651
- SSDEEP 1572864:dH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+q2:Csok+oK71
- TLSH
  T140988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
- MD5 e3bdb59b37b730647d4a1e44756a730d
- SHA1 bb435a479fa6956f3d091c927d12c2f71e433c35
- SHA512 891a72c6091ef4fde7a373f6df0f1e39d40bce67a1a7f8509782c6373baf481a73276051b77d5946875d1ff449ca23083635e4f4030058f7b1bfe35135a1c98c
- SSDEEP 49152:0FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jhp:0F2IDq3CYVDdufU4i6hp
- TLSH
  T178D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
- MD5 c13e55ae6200e74c0b121cbd5c1d323d
- SHA1 098675729109e19a0b6cbedbbf45398265ab6644
- SHA512 b7f802afd0e195c47cb4014b2af2a532781648367c2fc6695d2142afa6b65a35c699a4bea9eef5694e01ec863b3c259a9a3bdead4d889195a9b22dfea7461f1b
- SSDEEP 6144:43f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/88Pg:6vQ0CxmqvfbjLTQRU3y0iSA8o
- TLSH
  T14FA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
- MD5 a3bf08772053b66ec34701037f120736
- SHA1 b1b8d9e35d9ea517fe435f33056e8d2ff868cc6e
- SHA512 67b294ddcbc1b26c65c252ebfb1d770b81df380e27b2b9d95be6d540c6c017ca7d5f700e42e6b41dcc52866f3b32382e3b88b585cf5793e5decb5d905d2fb539
- SSDEEP 98304:O9aDUngXCAFxUrAYF8V3tcUl1XMX43vlOA:OCO5k33X4svl
- TLSH
  T1CB867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  resources\stratawx-panel-2020\html_ui\InGamePanels\StrataWx\index.html
- Size 75KB
- SHA256 328ab13bed980685fb7ce131bef8be9c222184551b593462331aa2075a8a9ca6
- MD5 4a32836859bafc1cb2b002f7787529c0
- SHA1 3e11ec67d4c57e1f795bfb33ff69fac1df267ece
- SHA512 dfc29f861e8396adf52035d0469fa256b0bd7de6855eede823403a3ed34f9571a8776c1e7421c1e5e9166324fe38eb4e39b78841ac6e0a10fb25dfc4b6131ca2
- SSDEEP 1536:8mmrNNRus13bJSAuXGFH+DyXrezUg4eiHd6XB+Gof/vssPz0V:wVFxu29eiIB+Go3vX0V
- TLSH
  T1AC736DA7BF0C5335901342656B7EA399E33CA83B06421954FD9EC074B3D58BA533E9E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  resources\stratawx-panel-2020\html_ui\InGamePanels\StrataWx\panel_code.js
- Size 917B
- SHA256 a4d0c7d3d3cdeb94d10f5a0a3d7086a05230251ab17cac97a02f216cacca9070
- MD5 c0cb28a9861a4b04f2b2c71ebc60a4be
- SHA1 5e216fa22cfc670d92088c3bf71689934214bb78
- SHA512 d2fc2cdc197e13e53ab37e8f4655208a876f1b4eddc181ffc4053860e8c7e30d9da3ac2834640d7aabfbafef483e58427850348a6c773723d0d15e39476c9642
- TLSH
  T1471144436FA5E37612B141CE4C0DB1CA85451A377F374CA492C80168BDA212775D37FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources\stratawx-panel-2020\html_ui\InGamePanels\StrataWx\stratawx_worker.js
- Size 218KB
- SHA256 5634a0fc71609fbb3e845c14fd20384dde520d635c0c3d4e2ff95d95e9af22ac
- MD5 efd51a2dc3c7701938463712f1dc9a10
- SHA1 df0826b9c43d83636d5c7e1d6e8462d2fb225e8d
- SHA512 e5b0cd9da339f13b0cb9ab1049d3c81e5845eeed26affcea383335a39c1fe0d2f3ce73903a89c4870b2234fc35935b8c0a91aa8b560e8952980bd2f02bbdeebe
- SSDEEP 6144:uBO/UkNDLP+vUaOL+Gdgpq5so4ZF+JWSAiv3C0gJDWPa8kp:QDkNHG6Dd/4ZF+JWHi2DW6
- TLSH
  T18224076BB78503362E1311B5AB4F72C1E729C0639625D190B89F931C3F4597883BEAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources\stratawx-panel-2020\html_ui\icons\toolbar\ICON_TOOLBAR_STRATAWX.svg
- Size 5KB
- SHA256 17f5b7260f6439c4843f0cacf7c3232c24983949a75a7f10de0b7ae4e56877d6
- MD5 f484158c55605158bfda3b901b697d63
- SHA1 b672f029a0c073f74f8723e14e76579645fab317
- SHA512 05b3fe4610141e710508f8a32aabf824b8a4713a79bc769086eff62536f217f7d36d568eb6cbdaa52de04b2a1932c9fe6444aff0f68f75317d08533c41094047
- SSDEEP 96:67PBFfFXewGo12PE0STPrNayIs9Xz1Fk5wIvQsnF5f9Cokv0feCt:AFtXESPJNPPFkKIvrnF5zmoV
- TLSH
  T14BC1F626F388B239C50106BDCA2E22DDD23EC15503169A117F1E923E7B24D76653E5FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  resources\stratawx-panel\html_ui\InGamePanels\StrataWx\index.html
- Size 75KB
- SHA256 328ab13bed980685fb7ce131bef8be9c222184551b593462331aa2075a8a9ca6
- MD5 4a32836859bafc1cb2b002f7787529c0
- SHA1 3e11ec67d4c57e1f795bfb33ff69fac1df267ece
- SHA512 dfc29f861e8396adf52035d0469fa256b0bd7de6855eede823403a3ed34f9571a8776c1e7421c1e5e9166324fe38eb4e39b78841ac6e0a10fb25dfc4b6131ca2
- SSDEEP 1536:8mmrNNRus13bJSAuXGFH+DyXrezUg4eiHd6XB+Gof/vssPz0V:wVFxu29eiIB+Go3vX0V
- TLSH
  T1AC736DA7BF0C5335901342656B7EA399E33CA83B06421954FD9EC074B3D58BA533E9E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  resources\stratawx-panel\html_ui\InGamePanels\StrataWx\panel_code.js
- Size 917B
- SHA256 a4d0c7d3d3cdeb94d10f5a0a3d7086a05230251ab17cac97a02f216cacca9070
- MD5 c0cb28a9861a4b04f2b2c71ebc60a4be
- SHA1 5e216fa22cfc670d92088c3bf71689934214bb78
- SHA512 d2fc2cdc197e13e53ab37e8f4655208a876f1b4eddc181ffc4053860e8c7e30d9da3ac2834640d7aabfbafef483e58427850348a6c773723d0d15e39476c9642
- TLSH
  T1471144436FA5E37612B141CE4C0DB1CA85451A377F374CA492C80168BDA212775D37FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources\stratawx-panel\html_ui\InGamePanels\StrataWx\stratawx_worker.js
- Size 218KB
- SHA256 e416b57bacae9a0b7484e87e4f2aae800217faf2bba1e905c916f08a2a6db3b4
- MD5 f00473dbc05e66caf6e3d7735e151a6c
- SHA1 4d1573a594aa82764f42d58c56339cdc0323ced6
- SHA512 17b2d9b9cd6a404982222f74175c3081e86fd2e577d199a5c309099f441fbfa8d3756308a28534050578cc3731e2ee83ab9383738d50a4bcfa2c7753f36b2bcf
- SSDEEP 6144:uBX/UkNDLP+vUaOL+Gdgpq5so4ZF+JWSAiv3C0gJDWPa8kp:QMkNHG6Dd/4ZF+JWHi2DW6
- TLSH
  T1D324076BB78503362E1311B5AB4F72C1E729C0639625D190B89F931C3F4597883BEAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32