General
- Target SKlauncher-4.0.54-setup.exe
- Size 122.0MB
- Sample261017-trwpdshy2r
- SHA256 8fe5168ecd41fcfba4d360998ab95ddef4655c3eadb47aa956ea0b1dc41854d4
Malware Config
Targets
-
- Target SKlauncher-4.0.54-setup.exe
- Size 122.0MB
- SHA256 8fe5168ecd41fcfba4d360998ab95ddef4655c3eadb47aa956ea0b1dc41854d4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSES.chromium.html
- Size 19.4MB
- SHA256 c971fa90cb787337e9df73773f3b43cd5621f035e53cded439bd927b3b759e0c
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
Score1/10 -
- Target dxcompiler.dll
- Size 24.4MB
- SHA256 e00e2c37cb8924389a0363691e65a58e8ac2da9093f3db80dc8f7a5b89253fdd
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 af461f247e8bd008eee24e9954be9a6aed6402c50d716e16fab2b8a774ed98fa
Score1/10 -
- Target libEGL.dll
- Size 457KB
- SHA256 ca19e6fd75c9c1551dfdf0f5749f2e4dba73ea0d452de4ef5534e30a5558b34c
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 f2cf8f5477d6ee06e84e55b2e947871f709fbf0ea56dff22c73acb7743d0e0a1
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target sklauncher.exe
- Size 228.0MB
- SHA256 87e7f7af6333fffb4f5472258ea16fd5b69253caa439e4271da764959c26c260
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
- Target vk_swiftshader.dll
- Size 5.3MB
- SHA256 be32093f330a57cc3bf31ae4e32c61ef0c6b751a9212d1d8507fe8394e2f2859
Score1/10 -
- Target vulkan-1.dll
- Size 902KB
- SHA256 f7d669b9239cd7a460d609cb60c202dccac5253ffaf68131cc09c969fe59334a
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall sklauncher.exe
- Size 208KB
- SHA256 83363cb067a800015c3363e3ed17e311c96abaa23d4cd1f5e838047ad4d860c7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10