a9cb21507a6243f1bcd1d50283eb34fe8ed7e5cc7bac4e2f446bd799bc9dba5d

Sharing

Copy URL Twitter E-mail

General

Target
JBeam-Forge-0.19.11-portable.exe
Size 123.7MB
Sample261107-wh2kdszzaz
SHA256 a9cb21507a6243f1bcd1d50283eb34fe8ed7e5cc7bac4e2f446bd799bc9dba5d
MD5 e4b8ac66a861837efb8a1fb410beaff7
SHA1 6a24572b2cb239a1fa74044b5c3bcdc59d4b0bca
SHA512 e7b805883cdb1b59f31a4a7341dd5c7ed1f43b51fa0d5125b1927151ff0df3006f50716393c99d17168802c21189f199921ce9404c5f67e0a5c3d6f1b9721510
SSDEEP 3145728:DuSLf7PyainOBFAKNkCg2ak1fG7pQageZ6x1CYxc6DqldPFE7:Dusf+HMFoLk3avZukYqd2
TLSH
T14B58335807AD045FCF93C9F012AA01A4AF20DB1AD7FC41C71A71F98CA7A7E4ABB5D191
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  JBeam-Forge-0.19.11-portable.exe
- Size 123.7MB
- SHA256 a9cb21507a6243f1bcd1d50283eb34fe8ed7e5cc7bac4e2f446bd799bc9dba5d
- MD5 e4b8ac66a861837efb8a1fb410beaff7
- SHA1 6a24572b2cb239a1fa74044b5c3bcdc59d4b0bca
- SHA512 e7b805883cdb1b59f31a4a7341dd5c7ed1f43b51fa0d5125b1927151ff0df3006f50716393c99d17168802c21189f199921ce9404c5f67e0a5c3d6f1b9721510
- SSDEEP 3145728:DuSLf7PyainOBFAKNkCg2ak1fG7pQageZ6x1CYxc6DqldPFE7:Dusf+HMFoLk3avZukYqd2
- TLSH
  T14B58335807AD045FCF93C9F012AA01A4AF20DB1AD7FC41C71A71F98CA7A7E4ABB5D191
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  JBeam Forge.exe
- Size 234.6MB
- SHA256 d43692c0903dc92edf552febbf3451ca1ae0a487fb25ebc8b0f68a6158ca4b44
- MD5 7f6df33ecd477c50e9b00b319b2690a6
- SHA1 e6afbdcea103b5485dc3988eb924cf5fd4292c34
- SHA512 93248b5a4c4e8da053b0ac98ce0672f81c5418ed3af583763db700c3f517547798c27526d35a07f1331d4f69c4073db70ab0cbd9632d7541984804cf45174786
- SSDEEP 1572864:3zANHaXBxaT29v/77OUnNiqlCC2aUJKLe+YbwNUSzay78EfWdjOKU+WG1RHkmHZ8:cNHTK93fsvk
- TLSH
  T173C88C03F29641D9C05DC1B98B5A9633FE71B8094B25A3DF2B5447922F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral7
- Target
  LICENSES.chromium.html
- Size 19.5MB
- SHA256 7b328b8c7463ac9bfc7dc648c751533517c8441a0b5b21047d6c0b2620e60d70
- MD5 142cea93256b2b7824b854c62af026e6
- SHA1 265c66c606344122b35f20c68086890017a75505
- SHA512 82c7f1c6f17ba0af42ad552062db614bca8cbb6c317a456d15c6199f11b031decf2c0816770b0004326830899264a5640796d1333c524979f9dfcf64d7b57fee
- SSDEEP 49152:ZehWCrdOOoVo5TYp2xnuCQpc3txsJM+QAFId+wi4WMEAccr:y
- TLSH
  T16E27B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxcompiler.dll
- Size 24.6MB
- SHA256 e389f028b89a7a1459e730968a1fb8e4218bded24b05c761df16f1c80b1ba703
- MD5 ac0da17470240eb01c25e924f0d7f26e
- SHA1 c211b39339560ec3b38d8dc658def4999169b38a
- SHA512 e9fbc0ba4d9f68e45480042451802094cb0b6862b11c16ae58f8ea81cfeaedb5068a85ee8d63eefaa64b0a8b69a071230a838794c9e4ca122c8d417db2636495
- SSDEEP 393216:EBysgIIm/08qOXkkT3crWtoSX1PjZ091ex:ErI6T3crlSXI90
- TLSH
  T1324729122646D49CC099C879C7678B268A6C30E73FA7B9DFC0B461252B79DFC4B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 22e07be5d900ecad1fa47cbd9f783143af0058e18793b4804b887253988273ac
- MD5 c3c81108253132a71eee4dcb40bf51b7
- SHA1 833beef3aa2eb6c00ba451e1b48fc706be632f94
- SHA512 b0abf4dfe34411e0dc241fb4e4974af007652309430d371b383c7c8f94601e208249ae56c860f45098fc073c8fd1ad71706ca8ecff6d6c1a4bfaae1b1173dfca
- SSDEEP 49152:Lagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPkuf0E6OOlz2G1:LJ1lS0ZcoAs9HaLuMhe
- TLSH
  T1E6E5AE02F6D251EDD019C03497AB9213F271780A8F205AEF17A05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  resources/example-extensions/beamng-importer/main.js
- Size 17KB
- SHA256 1c3b4d4bf63dfd0924d34e8da282e6d9f4a5862faaa36591749ce31f7097f33f
- MD5 a68ef0110ed13ef70ff69155a13729ca
- SHA1 ead193f07eb87e970725bb7d52e9d590b8dc2703
- SHA512 9e57da4b29b04487da570a85c18542df9ffd46c0cb9ea83e05e61dd003f53ad33c46ffbc952265af88c4078c544c9d1d7046f7f2497c8e5d5ea4b461d3f37755
- SSDEEP 192:519Sy3NfKzdU+d0EapRQIEE0gwRiZwladUS8rL1UJPqvfK77WWq6lS3ACmxloC9Z:dSkG6VWRqxQfK77WP6nroyopG1Do84mz
- TLSH
  T1A782E9826CBB211205B7D0A10547B026F63DC1477289E9B4B7DC92742F82DA585FFBEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/example-extensions/cms2021-importer/main.js
- Size 6KB
- SHA256 b7817f30cdcb4dd90a59f2f2b4bb5842fa901d90e1a3b6fc99a574a212ab353b
- MD5 e4cc7f87b893e9f9f475a0f66d0183c1
- SHA1 d184d145179b80a42e33ecf9277fe7df1f039370
- SHA512 60edd7955e632c76d5b4bb855834b7b5f7bd92a01fdaa4f33a232d35c22a142041a7e8a7c94412cbbb39cdd2068d4ccfd822b10031f2a0087a88491aaaa9fba6
- SSDEEP 192:MLT/l/p3B6EF3PSeBN3qGBF4Ze/UgxPEkRW/rVP:MLTp6q56sEeCHt
- TLSH
  T190D1F8A779BB227B003E10D12B4BB017B91DC02A721BDDD2329C82101F459F49DEBBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/example-extensions/forge-toolbox/main.js
- Size 2KB
- SHA256 33ab6a2c48c86004ef7cc2a9e291b99fd67032e9928f26214d21f1b7517e557f
- MD5 3cdd728fbef884f54d8595efe060d7d2
- SHA1 126e207d431bb000ccba410ac2098a342dfc4e90
- SHA512 df061f584e500c0d45155b8ead1084b00e562397c6fc127bdb34e39bb19abc41973f556386900b11f57423a3f4688537692af82514118729c40c3e6de6ef41e5
- TLSH
  T10B5154E6A87F623465A6E0DD4B4B241BB73ED1023388E07176DCF7101F466D094EAA9F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/example-extensions/mod-checklist/main.js
- Size 2KB
- SHA256 dab2cef87c7072eb657ad105bc4c73b7228f0f86b607b50c66855dba626fb870
- MD5 fa5cc9beab0f808fbbc4ea63809ba85b
- SHA1 f739df0a700de6c991fb0ff1557eafcfb025d7c4
- SHA512 b828852b9cedf7441fd65c99f467a53d7a8d5983b11ac783d753d8a74e58706fa77d8f8a78fe0b58540ae822e404442356b0af41d4c7c2bc367e887a8baf4946
- TLSH
  T1E4514296597A623D22F71A9F4E8B500FF33589123205F0947DACE6002F465E357FAA8E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/example-extensions/quick-adjust/main.js
- Size 3KB
- SHA256 97ee96046c4055735751dbb60914b13a75a8fc6cf92a07ded01e901b5bb466c5
- MD5 fdd9fd983268f2aa7b40ddda2d4ec60c
- SHA1 f7bf1494f8098eae1f472a2b8cdd2a838e364b4c
- SHA512 aa176f5fa93c276173244efafa64d964a4e89c71e03d623bcaea5a8567e4ea17694155358565749a9dc2d5b71941e3d525614bc4a67ce1a37578d4d595fe66bf
- TLSH
  T1667193E974FEB148C1A70078580B701DFA9EC802978AF554BB6CA5162F4422659EEBE3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/example-extensions/warning-lights/main.js
- Size 3KB
- SHA256 8bf287ccf17df8e0195069a9c04bce5444d28bd758e5bc5694faea11a55dbb08
- MD5 f9888c64451eb00e82e7191829de16f4
- SHA1 0ad85584a2a1c62c2068b6acb7581fbd3dab346a
- SHA512 60fa4c59c7d638b3e0450bbf262fb2ac922bacd3841f4a0ff74860f94f607dff5beaf91b93ffe43d30f29d30c952169abc043031b8f2c86e10b2a1a57cb7cf83
- TLSH
  T19A8153EFF067A376A61562FBC515C0466F6A916403593091F8EE8C09630EF3C52FE132
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  lua/ge/extensions/jbeamForge.lua
- Size 38KB
- SHA256 eb83007992e6de1e5be0a058bdc4240345329b04b2d6cdbd15014ceb328df4d3
- MD5 f6cd53d2598346e9ce1724d4f0d254e4
- SHA1 9bb0b8fb235b31679604f290cf18e879dd83e35d
- SHA512 8ff48c9c09ae7af6a594e22018c0a69ad8b293ae3f3a7e8c311c07cdd1698e4c34a824530b139185654cb2289072ae8c2c13b11bda7790f21c43629e98f5466f
- SSDEEP 768:q4hT8o5wCRF6aCG65KfIhMo9WW6PYN7N7Hkb8JhWq5gTM88n7TM/M9bDru5s:rzh6Nw8McHas
- TLSH
  T19403644FAD5B27619356E0A1D9872811FB36E872250D15D6B5EC53E0BB8022C81FFBEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  lua/vehicle/extensions/jbeamForgeProbe.lua
- Size 14KB
- SHA256 ba90e14779a73fb61f48fe6fcef3c5a0b5e4a69f94c697b8630dc4e07713de72
- MD5 aae496172fa87822ff23b8c1abf05521
- SHA1 6e61a16d7f1ea7d09e0a3d51600b979ab8d88a95
- SHA512 90a57043da083c0355a87bfe76cd8df19067d51c1ad15dc91473fc60910938e7ca3ea649c90df20dc2fd97056d606f837dcfedb40451358c7849ce65e0db4edd
- SSDEEP 384:c/vmAQaE3QsWqShdbjSTpCyY1YSnZMINl5YIRiwA6iYJkvXyOLgQGYU6L7U0YyY4:c/vBpsLSPbjSTpCyY1YSZMINrYIRiwAh
- TLSH
  T1E06283BFE301133062D2E665E9432819BE1AD03317191969BBEC88943F9165DD3FBB78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Network Service Discovery

Checks computer location settings

Reads ssh keys stored on the system

Network Service Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32