General
- Target investigate 1.0.0.exe
- Size 83.0MB
- Sample261023-3kshtsv13l
- SHA256 8f122030b3d9267e2496d0060516e11312ba830e35d6a1f2475d2efcad68194f
Malware Config
Targets
-
- Target investigate 1.0.0.exe
- Size 83.0MB
- SHA256 8f122030b3d9267e2496d0060516e11312ba830e35d6a1f2475d2efcad68194f
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 15.3MB
- SHA256 1145a9faaadf10f97ab6a1d0c5b7f74c6a2eae46b532f168a233b9a5cd7d52cf
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
Score1/10 -
- Target dxcompiler.dll
- Size 24.4MB
- SHA256 ece5d4a3aa8be7ddcbe81117282e8ea46e5a47d4504a0922084f242eb25f9d45
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 3d57a182416ee27825b363b6b5c55224a2a915fa65dabdcfc7c7993843da8e6c
Score1/10 -
- Target investigate.exe
- Size 204.0MB
- SHA256 f9a9f2a00d2b34450b2bac5e25f23bd1789354d29b1227efd2190cad6a4108ba
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
-
- Target libEGL.dll
- Size 500KB
- SHA256 9b336bb76628eab6952dad742e8edb6bb2d9bb3475048d797d2d21731b50ad7b
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 2247f485671a6ca032bf757e645902a549829f5174a20e912d1571b1edc1c100
Score1/10 -
- Target resources/app/main.js
- Size 1KB
- SHA256 7d7e8064b9b2a66ed0d9dc53cb89795f45d21a2fcffab8c007d9e3b3c8a6f144
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.4MB
- SHA256 775dfe872a730e9597aacafa1cb15d587390e66ea79c5d4afa686588add6a03e
Score1/10 -
- Target vulkan-1.dll
- Size 935KB
- SHA256 5a75141621ad5fa7e14264c0709322a0f0e1b946294d56319e7ad06f6270b236
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Windows Management Instrumentation
2Discovery
Browser Information Discovery
1Network Service Discovery
1Query Registry
3System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1System Checks
1