General
- Target loader.exe
- Size 99.4MB
- Sample261113-d89dtaft2t
- SHA256 00635b715db1f602c7e69541216ea243e27c305ae8acc6cb5baf08cfa755cc76
Malware Config
Targets
-
- Target loader.exe
- Size 99.4MB
- SHA256 00635b715db1f602c7e69541216ea243e27c305ae8acc6cb5baf08cfa755cc76
Score8/10Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 98.9MB
- SHA256 7e9effb5b473328151486d688482d0629c86f1dd8b6f3654cde964a5a398fd53
Score1/10 -
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score1/10 -
- Target chrome_100_percent.pak
- Size 150KB
- SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
Score3/10 -
- Target chrome_200_percent.pak
- Size 229KB
- SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
Score3/10 -
- Target icudtl.dat
- Size 10.2MB
- SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
Score3/10 -
- Target locales/af.pak
- Size 478KB
- SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
Score3/10 -
- Target locales/am.pak
- Size 776KB
- SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
Score3/10 -
- Target locales/ar.pak
- Size 851KB
- SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
Score3/10 -
- Target locales/bg.pak
- Size 885KB
- SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
Score3/10 -
- Target locales/bn.pak
- Size 1.1MB
- SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
Score3/10 -
- Target locales/ca.pak
- Size 538KB
- SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
Score3/10 -
- Target locales/cs.pak
- Size 555KB
- SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Hide Artifacts
1Hidden Window
1Indirect Command Execution
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4