00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750

Sharing

Copy URL Twitter E-mail

General

Target
NodeNetLauncherSetup-1.0.24.exe
Size 106.7MB
Sample261107-zyex4sft4x
SHA256 00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750
MD5 1636de733d71299400cc3f40adb3e479
SHA1 67531d41dce4cb12c3097db31d98b958bc8b9bf3
SHA512 119c2313cce6c8db1f00e38176ee302a4a42bf4eed9019ecdcac23484b70150a85bf8228939b4d0bd8f628906c6a8b777c3936049ab2ed9c20ad34184c9ac408
SSDEEP 3145728:3yuSLFnONAKNkCg2ak1fG7pQageZ6x1CYxc6Dqldijv:CusFGoLk3avZukYqdA
TLSH
T1D638339807AD045FDBA7C9F083A900689F30DA0BD7FD008A1A75F55CB3D6E4ABF29591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  NodeNetLauncherSetup-1.0.24.exe
- Size 106.7MB
- SHA256 00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750
- MD5 1636de733d71299400cc3f40adb3e479
- SHA1 67531d41dce4cb12c3097db31d98b958bc8b9bf3
- SHA512 119c2313cce6c8db1f00e38176ee302a4a42bf4eed9019ecdcac23484b70150a85bf8228939b4d0bd8f628906c6a8b777c3936049ab2ed9c20ad34184c9ac408
- SSDEEP 3145728:3yuSLFnONAKNkCg2ak1fG7pQageZ6x1CYxc6Dqldijv:CusFGoLk3avZukYqdA
- TLSH
  T1D638339807AD045FDBA7C9F083A900689F30DA0BD7FD008A1A75F55CB3D6E4ABF29591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 106.1MB
- SHA256 98bf21271e22ee615a72870ca75041aa4b5dc2e8cb1b84e98c07d267c76ead8c
- MD5 0ab5a7f4c3bce3e80b936940aa7156eb
- SHA1 2c687b1cd95b8f70347ece343f5f6a552af6b23c
- SHA512 ac4f3d9fa0acc1166d3b8901a23cb46d29aa6cd4d5ed7899bec24487d76fb997992138ac3563b2dddcaa90d034854322c5929e4e14e57884d8c7a945239e3270
- SSDEEP 3145728:iuSLFnONAKNkCg2ak1fG7pQageZ6x1CYxc6DqldijZ:iusFGoLk3avZukYqdq
- TLSH
  T16C383398079E045FDB67C9E083AA00689F20DA0BD7FD00CA1A75F55CE3D6E5EBF28591
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 702KB
- SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
- MD5 8bd180ba5ae087e7348c8e5d3fc747b9
- SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
- SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
- SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
- TLSH
  T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 1.2MB
- SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
- MD5 62dc1994f062c83fce3944c829165007
- SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
- SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
- SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
- TLSH
  T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
- MD5 c9d17441b2314fe514cd8cb951577c1c
- SHA1 15cae4dee805f3e04171e00781da13fe40036439
- SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
- TLSH
  T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 621KB
- SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
- MD5 cd886deabac5d290bcfe505aec6d2936
- SHA1 33b05211957f11d5d5bb563258b585c30ecd8870
- SHA512 b1c79724837e2b52e5015dcb9c0b93472dca52e1c392c5b6bec3f554d3b77f74b1a0d118ea18ddf6abc8dfa175b8717a1a6c7344d479c7246bb1783e5cb9ae96
- SSDEEP 12288:M1MEn7kwUPQ6tRGtAX9F17ZrzgNslCFW+pyGpgvi4H2Jyn4NsmUAAL/5THozvbjx:Mr7APftRGtAX9F5ZrzgNslCFW+pyTviB
- TLSH
  T103D41B0AEBC1273D09A07696FA0845F7BB5D626CC770F2BADDA982310966DFC10BD1D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 1005KB
- SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
- MD5 6d22dcd650f3157f3b500d609c630b76
- SHA1 fb063a5bfae0bdc3649e772e9fd86c285b26f954
- SHA512 c27e6ab4b09c527ad462b968b02d1bf85205a62f16a63bf0b97a26d1f979c69113799cf8794ff2ddf3f1a3d360d267811fc4990d1932a788b9b6e653399bd091
- SSDEEP 24576:O8VvT31VYRThTCKHyWVt10RTjHgvvevzFI6XdOdvwilgB1VewHZtPoIp:ZVZBF
- TLSH
  T1DC25AB547EF9F7570F8E8A1994320E4F9594AE4652802C38C35AE3FC2B2DF1B4DDA219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.1MB
- SHA256 4c47004abd0969cb1174d06eb7429c024872207960986afbf3cae37e339a8d01
- MD5 c46ac6ec24a17487c65e6c841d16735b
- SHA1 e8c2ff9b78fa8e4ba463f3bf9d2a9e741ef1c1cc
- SHA512 21a67968bf005fc7c36ea109c2328c8333af757c977aaeaedf18423a3702d5630eea6607c4e834e400598f3c8bbc185921dc14746415cc6ea27f3735bbe0feec
- SSDEEP 12288:rlzJhtfsBHApLxC14Gei8wj3ri2XYrvZU4pMk26ISeQN7+E6W0ZYJ66:7bkEj
- TLSH
  T126357BE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
- MD5 651366d5dc136aee8364ec625a917f9e
- SHA1 9bfa9240d8e675a00c77608668775d9036c9a0a5
- SHA512 90b84232f84cd67e88ea99af7f274629286ae02c292dd610ef4efeaa7ed4154ba7048e415f62a5c98fb785c8e4377deabead87aba2cefc1fed7a3d3429d52019
- SSDEEP 24576:uuI9WglWLYxgCzQkEC1U1Vb6lNs7e373ZGm+X4KxUfVDIohD74uOVnaNmu8BtTJ1:ux9WglWLYxmEU1Vb6lNs7e373ZGm0dU4
- TLSH
  T1D24524A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/bn.pak
- Size 1.4MB
- SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
- MD5 668f9188aa073a9a1c706fb67bd1de92
- SHA1 9e0b1912544d3c722d41ebbce8abcec30d606c69
- SHA512 60071949463a9029c15b5f85aee8c2be008fa97bae2e07d11bda922ad92066cf92dfce0d25115c12f785c94fe1d5aed390fd29cc47fdac6620a6f16bf401a5da
- SSDEEP 3072:cCpCO+qbfG/1xsOktuHrcKqt2DOUzhUygJfGCARuItWNAypbjBbLR3QXQcjC8wkz:cCpfFfGr7ktuHlIAypbjBbmwOqM
- TLSH
  T16865EE209C6E81B6A8C5CDC9434C6370C123AE9B9B65F74DDC17A25538ADC3C8CADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/ca.pak
- Size 700KB
- SHA256 6f28297c1ccb628f534d65dade167ae559f83eace359acf47e48ff890b9409d5
- MD5 ddf227a00ab2b50a8de153edd0309499
- SHA1 aad2e096c7b13afaaafd01261602fee51723eff7
- SHA512 f10992e172cf225450dd4c90496201b19f30a57247c87a63313addb829551e1d07028f53a22cc6a94f4413963da6517aafff2f54480ad25ad327da95d8967010
- SSDEEP 12288:2ztZe+rqQR7IO4yCiX7rmipFa8i5PsFzN3Mw2juwwPR9zejm0t3ltuFTjK85nCRC:stZeYqQuI59L8wWqTM0zrcC77JEw
- TLSH
  T1C5E4F8239BC93B7744D3331EFB46C253B48CA9847A06D254F4AE0B1622CCA9CD677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Network Service Discovery

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32