3d18b5d1d234322a640455835bd031525551dce93509b891ff4e27df8b9b3291

Sharing

Copy URL Twitter E-mail

General

Target
Fauna-Setup-1.3.6.exe
Size 69.7MB
Sample261026-rhl3gset7t
SHA256 3d18b5d1d234322a640455835bd031525551dce93509b891ff4e27df8b9b3291
MD5 b5eb09ad01e177a26ce2d451fd61c424
SHA1 e3e48a58f50d0a6a6f82f7cde0a46f8be7c7b73b
SHA512 f31e2d6a080428855ed057f68259481cb567d5154225a625cd38edfdde46b778b8b511b21407eb0846a1714d4705feaa727c9d39592ad6d95ac69e4f190908af
SSDEEP 1572864:dXGZ7zniTbN1wLoVZRMS+wRL0trxVWZarfJxxMue:d3Y4RMSsVWZWW
TLSH
T1EEF733099078C867D112B83A7EB1B3A1E3EB4D901AA3AD6DE9C8BC1DF1985F4D51C43D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Fauna-Setup-1.3.6.exe
- Size 69.7MB
- SHA256 3d18b5d1d234322a640455835bd031525551dce93509b891ff4e27df8b9b3291
- MD5 b5eb09ad01e177a26ce2d451fd61c424
- SHA1 e3e48a58f50d0a6a6f82f7cde0a46f8be7c7b73b
- SHA512 f31e2d6a080428855ed057f68259481cb567d5154225a625cd38edfdde46b778b8b511b21407eb0846a1714d4705feaa727c9d39592ad6d95ac69e4f190908af
- SSDEEP 1572864:dXGZ7zniTbN1wLoVZRMS+wRL0trxVWZarfJxxMue:d3Y4RMSsVWZWW
- TLSH
  T1EEF733099078C867D112B83A7EB1B3A1E3EB4D901AA3AD6DE9C8BC1DF1985F4D51C43D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
- MD5 79c27de4d1c6d295fefaa70f608f1c67
- SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
- SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
- SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
- TLSH
  T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Fauna.exe
- Size 120.4MB
- SHA256 4a76d19f3a30b74f3df1b21b0936e6fb29747e7b1df1742ae13a5aa4b262a8a2
- MD5 a346cc3e205aa651e12b0f7656a8bbb3
- SHA1 155b888d276f08b215fa73a5bd6f553ba6ce3cba
- SHA512 4cf2c961889950a50a3962ae3028bdeaffa2a3050989280f410748227f7f18a018736b20ef461f69a5cd61b6a3e78d3c7303c7cd2128ab4eccc9bfb27066ad32
- SSDEEP 1572864:61f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:Xasulbg8yTnbEOz
- TLSH
  T1AF588D13F2AA10DDE04CD1B59B4A8636EEB1B8450735A2DF265127162F7BFE06B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 4.5MB
- SHA256 03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
- MD5 d4a79b5d46f0931b9eb7125fd40baff0
- SHA1 3a38fb263dde2251b9fe157b5fddec7acb07c53e
- SHA512 17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
- SSDEEP 24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV
- TLSH
  T1FC26D66BBB49037306F282626B4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6
- MD5 eabfc10d56cb44a86493cb2f8ca7aab2
- SHA1 09d7e87f43527333cd021329d6c2f4e8bd8ddab5
- SHA512 ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec
- SSDEEP 49152:YISWBURglcWlJUQSyPV3cZ8RxDZa+DmXfUStDw/JcImohiiMoFwEgy:YPnvdZoJpMoQ
- TLSH
  T1F4D59D0BF2A645DDC019C53483AFA233F934390A0725A6EF16A15A256F3FFD0667EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 438KB
- SHA256 f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85
- MD5 660a9ae1282e6205fc0a51e64470eb5b
- SHA1 f91a9c9559f51a8f33a552f0145ed9e706909de8
- SHA512 20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263
- SSDEEP 6144:79h+56bG/eyllh9g1Kajo9wEVzZJAWpf4IBL75+Hjr:79Jbwla1KoAwqf4I4v
- TLSH
  T187A47D16B7A508BDD066C438CA574A42EA31B48A0F61E6DF03E4927D1F7B7E45F3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.3MB
- SHA256 a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10
- MD5 bc45db0195aa369cc3c572e4e9eefc7e
- SHA1 b880ca4933656be52f027028af5ef8a3b7e07e97
- SHA512 dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f
- SSDEEP 98304:txhV5ahd7dNgHB1g468F4p9+7ULjSLy+W:tDVEhd7dcFE9+kSLx
- TLSH
  T10E767C07F2A540DDD009C2B98B4BA212E630BC851771F6CF269477152FB7BE06B3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app/boot.js
- Size 3KB
- SHA256 6534a43cb43c50eef5f31a8be61365dc52737e6ac292afb20595be69015e6f76
- MD5 44825704de80d2e95c15785ac0f8bc83
- SHA1 35c3b5bc23d3cb60f3ec3c6a26d656dce7fe1cb6
- SHA512 51b50d6a1a896198dec50b097ea91d4e06b68847d025fc9bc29e78c4087665889bad6ed3942193216dace281d3d2d84b587344f083b46924d0e3ac3e94688f83
- TLSH
  T1C861689B21FB83385AA6A29E164E501C772DC572719FDFC57CDC11802F8342D07A66AE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app/captchaPreload.js
- Size 276B
- SHA256 b9e1da3198f02dbafe377d8e5a4f5daa49959744ef7c61c52b2a7ce825718f60
- MD5 40c573cbdee883a4799d0482ece0f753
- SHA1 91d97baa761cbfbdc519ed7191dac72386a3ecd8
- SHA512 b5f129f9d591106b4e8c4447363a1097a9bc30fee2cc8e0a74f4904a1109a20b5e4b84e3233cfaadbc0cd314c5b314aadb2cd52c23d64fc9ebc373e5c1162076
- TLSH
  T1D1D02BB501AF9DBD37161AC1A3474C86ABD5C028F12DB5708704C0AA3ED84CA421BFCC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/app/device.js
- Size 7KB
- SHA256 2e2886cae1745024945b1bb232aa8ade72ffff92f9dced735f3537fadc6ac98f
- MD5 243cd797f98bd4a183823dbcb4e83d48
- SHA1 059beef7ca20e0c8968f72b2879a7e19f5d0989b
- SHA512 4e207b0d7e9d869cbc813b815551587149b0c9db6439e5948db576d48156e7645aedb6d176ec752f279df3b272fe35c86a659058374e0dbc2b09eec1d05936ad
- SSDEEP 192:rWoqneRiK/w24eM7j312mBx/V6lYXkx5C:KXnepnY7j312mP6lYk5C
- TLSH
  T199E1E61952FE2275266624E4166B981377B2C1433089CBE576CC4180AFDF438C5F6AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app/discord.js
- Size 5KB
- SHA256 6a18398fbeb78410915499517c7fef64348a2ca4246bcf9702291424c85d7484
- MD5 f65b25613b08168bd02c39e66c24b0c6
- SHA1 ee519ccf0cb2d88a34a2475bce873d809bae85b0
- SHA512 3d7388c2dc25f3a6e8cea8a07612047229a162cc527ee90be64309f4067c5c96374418e82c145d94e37f1f9e4aab557d0848be32efff9f16c4521668013909f2
- SSDEEP 96:kRJweX0oLiGxV7ukOF1Ul5se/9n3IkSUymysB21ETFJy8T5V5m8T2y4iZK+/9a+j:SqeXHx8k61Ulbt3IkSpHs81ETFYynz7x
- TLSH
  T129B13306AAF21236117331EA056AC8477326D403734ECFA6752C46287FA667DC6F67CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app/gamePreload.js
- Size 889B
- SHA256 1260df0706b83ddc0af4e66d5c4f7d74f7a9821ffd3ce5576ff0852017eadb0c
- MD5 8a963ceefbc3ce1b6a4b30ab3fda4da2
- SHA1 fededccc30fd4d044ae36f69a7470d212a048396
- SHA512 5399d2a2a43465d5f4bc882bc19908546c15bfee82b6d64f20ce7637843a9f4dce5eb1d151f84f6962ced6ac0d446ca57953539e83655e0fc762f15c1019bcde
- TLSH
  T1D811E09014E6141B73BA30AEA44229163D76FC71E44C8A603A6D01E1BFF61D2892978F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  resources/app/index.html
- Size 71KB
- SHA256 fa101115a75d193b4fc75e7315069fb731199bad0a337491861e34d2f2fcfc05
- MD5 cfdabd620b778d130b40e9432d1a6898
- SHA1 b69b6bcdb88c8532ac5f3887c87acfa5a44096f9
- SHA512 83b66bd2b34b8ccc3c238a0ecce19a7729132868817696fce12273ff5886760c231c3281b6e6902aeb9d975a948eeb411b6498201d4cf2668fde648275027615
- SSDEEP 768:m0Cy8Fkf9F8I/nq5/TRlluFdGou+KgopuduphrN28aBk+zBVLnIRYeqWcw4NRAW5:vCy86EI/ElluFdquduptNFXQRJ5L
- TLSH
  T10F63092561BB06375A3351B42F8BA105373990037245CE6C7E9C8B849F8E578C6EF7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  resources/app/main.js
- Size 26KB
- SHA256 9d12f73797de62569f19195ed62bcb9a847abcc87a6e0e895d3a7f2377e49c86
- MD5 2036a852d7b9645eb2523f4700a07575
- SHA1 a05b9e9a9d42a3ff9611d7796d2827c4922c7b30
- SHA512 5a8608f9cdcd794fa5a8c460d32376a2f7a91ca49230f3a9fad4071ed45c90da22d26e2d7a9ba748c93d260fb12d8f05cedd80e60797206390e1a35c5f4b01e0
- SSDEEP 768:N5KhptLh7PiZXc09ii2PBAyBsvwctspQPRNaM4T5j:NgX09T2PBesT9
- TLSH
  T169C2E75B61FA223A067344A81B0BA157B33AC033315CEFA0758DA5583F8963D46FB7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  resources/app/preload.js
- Size 2KB
- SHA256 14e47ef5be8139d3112baf4121054e42fcf52381e1d41b161ac60cd6fb013164
- MD5 0ea1e7ded9d057eab5b0f2b7bc63802a
- SHA1 0b52319ce2259d8e817f9587acb79239fceaabe5
- SHA512 bd0835bec92c290de29e9d14f409270a105ee0d0159a47b12a89bc2867ef8ba939763c1b5c88b94b15d7b2b4b8d075959c37a99ac14cadf270b51238d7cbe1b7
- TLSH
  T19241F0A9580FE67F0BC261A3F7177956231E4C24A41DE084420E85F7B68DD3842BFDE4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32