Overview

overview

10

Static

static

3

archive.rar

windows7-x64

3

archive.rar

windows10-2004-x64

3

amdhip64.dll

windows7-x64

1

amdhip64.dll

windows10-2004-x64

1

concrt140.dll

windows7-x64

1

concrt140.dll

windows10-2004-x64

1

res_mods/1..._a.pyc

windows7-x64

3

res_mods/1..._a.pyc

windows10-2004-x64

3

res_mods/1..._a.xml

windows7-x64

1

res_mods/1..._a.xml

windows10-2004-x64

1

res_mods/1...me.txt

windows7-x64

1

res_mods/1...me.txt

windows10-2004-x64

1

res_mods/1...me.txt

windows7-x64

1

res_mods/1...me.txt

windows10-2004-x64

1

setup.exe

windows7-x64

10

setup.exe

windows10-2004-x64

10

updates/icudtl.dat

windows7-x64

3

updates/icudtl.dat

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    archive.rar

  • Size

    9.7MB

  • Sample

    240622-14zeda1bkj

  • MD5

    5b61717757e05f71db4397b2b4fae79f

  • SHA1

    87ff0f49285e5b268061106e190bdc7a2858ef63

  • SHA256

    2f718b6527df6babca62b1c7e0126bf18ad92927ecf9baf433c5f6808befd063

  • SHA512

    abb9afc4a963a633e4a627755b2cc32fc0c5c11f09518982144a7a04ffd625be950b81c35b57692142e8a18cae603738d8781d40d94e05bd1d90e53340e4d2fe

  • SSDEEP

    196608:pS03aSSqjia+n5raUAb08CpmHiVGeHUQGjrnDFhhOhBojv9s8LgUMXc:pl3zl+/raUVVGSpGfnDFhemj1VLg5M

Score
10/10
privateloaderevasionloaderspywarestealerthemida

Malware Config

Targets

    • Target

      archive.rar

    • Size

      9.7MB

    • MD5

      5b61717757e05f71db4397b2b4fae79f

    • SHA1

      87ff0f49285e5b268061106e190bdc7a2858ef63

    • SHA256

      2f718b6527df6babca62b1c7e0126bf18ad92927ecf9baf433c5f6808befd063

    • SHA512

      abb9afc4a963a633e4a627755b2cc32fc0c5c11f09518982144a7a04ffd625be950b81c35b57692142e8a18cae603738d8781d40d94e05bd1d90e53340e4d2fe

    • SSDEEP

      196608:pS03aSSqjia+n5raUAb08CpmHiVGeHUQGjrnDFhhOhBojv9s8LgUMXc:pl3zl+/raUVVGSpGfnDFhemj1VLg5M

    Score
    3/10
    behavioral1behavioral2

    • Target

      amdhip64.dll

    • Size

      10.1MB

    • MD5

      da6bba744ffe35bd63e61ef2824ff15d

    • SHA1

      54f12b2bc458c72e071cdff727c4a2f7a33d0ab5

    • SHA256

      66d5725519eec9f0c16696c9bcf32ba3442551f36ec4bdb17e12f6e0d24027c7

    • SHA512

      74ba3f3c817fb0519b42e7f68ac8d87692e461c1a8529ae86051bbf891350bab05023046da6b69648681e26656624c97bac9707938511190e1dab8afd45ded4a

    • SSDEEP

      98304:FqFhXse/Y7jUHRRFcwETkorMg/696ffjZMXNDVjCXN2MX2:AXs37juRTcwETkGMUjZMXNDVjCXN2V

    Score
    1/10
    behavioral3behavioral4

    • Target

      concrt140.dll

    • Size

      309KB

    • MD5

      31f210ed5c6f2d8faa1d896cda18584b

    • SHA1

      5444d919f5014fb6bf58cefc6f01088c32a24a00

    • SHA256

      5393f592cded7bd8ae07b2afc3efdcc4a0b05f7e8e74380a267398266fc02d41

    • SHA512

      d39aa7acfd982759825b537a9ca5b04e6cdd9c0a28089e0f666ae4b75e84e2e2e58180103da38bea79efe3252cb9f1932efa69b64461cb76173645e8b6ddf3f6

    • SSDEEP

      6144:Ylm+bq4hSdOec4xWMXdtvo4KbrniIzb7wQjnWzgCE33g:pmP/eJXzvSCzW3g

    Score
    1/10
    behavioral5behavioral6

    • Target

      res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc

    • Size

      114KB

    • MD5

      a2f3ded45da8870e93e5d2186dab27e8

    • SHA1

      3f8e0cddecc3827b33ec02cd78d192c18f1ddf82

    • SHA256

      fc19237a4e9ae65829dbde384ce0de2c78b22d9577384dded9d4cde569a12742

    • SHA512

      438621491061c7f14f59c48d0d2fdd637a17c058df13417e21d660d81632dbb826a6144032f6f9192ab9bb0afb46b8f6cf3982879dc9942261c2538dbd17187c

    • SSDEEP

      3072:k6BVH7SBjeSCbupKVfG2yQJ23J+Svsy9k/TukuPMh:zrbKeWmDyQ+13kOPMh

    Score
    3/10
    behavioral7behavioral8

    • Target

      res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.xml

    • Size

      1KB

    • MD5

      ff03ec17ee5f13070dd50717620ffbc0

    • SHA1

      3243099738c6b40d2fdcaae8b16fef280b5eb835

    • SHA256

      8e7d953780ef22d302a154cc504a0e13ff031b9177f9b20708bfd8ee9ddad7ed

    • SHA512

      535f4c9f6911ebb0843d0d8c58b2613cbf5122281b50b056918e693e0db9d9daf54fb17b744ec14f95929673868fdb516f8d1f5330bf930a486c9d502fb7c2fd

    Score
    1/10
    behavioral10behavioral9

    • Target

      res_mods/1.24.0.0/readme.txt

    • Size

      53B

    • MD5

      1a4884dcdb1a8908bee1099dc846f896

    • SHA1

      ca6b6f8b0a5ee2116163c7c5026d65adebab61a6

    • SHA256

      83ab826c036bb841639276fa0e2b2d7dd07165cd2f17a039d0b3d0118d5c3f19

    • SHA512

      e8cde35ffd67c94386faedb5caa70a1d6c2e076138ffe5d0c418e60efd2cc8ca53d2ca3b9268897ab4afd2c0328aa7383ef99ee59145ddc72f20007095ef3fa2

    Score
    1/10
    behavioral11behavioral12

    • Target

      res_mods/1.25.0.0/readme.txt

    • Size

      53B

    • MD5

      1a4884dcdb1a8908bee1099dc846f896

    • SHA1

      ca6b6f8b0a5ee2116163c7c5026d65adebab61a6

    • SHA256

      83ab826c036bb841639276fa0e2b2d7dd07165cd2f17a039d0b3d0118d5c3f19

    • SHA512

      e8cde35ffd67c94386faedb5caa70a1d6c2e076138ffe5d0c418e60efd2cc8ca53d2ca3b9268897ab4afd2c0328aa7383ef99ee59145ddc72f20007095ef3fa2

    Score
    1/10
    behavioral13behavioral14

    • Target

      setup.exe

    • Size

      783.9MB

    • MD5

      386d43a253ba5c88567c4e67ee235ae4

    • SHA1

      135d0f03edd90be7ebc7b34b5da3b5a68e72c5b6

    • SHA256

      e281193854d3fb49b47ccddd7baafeb583970abae7a3814948d7e47b915429a8

    • SHA512

      aa0c9e881c8c16f6ee8275b11957dde23965cd6e1b733a67fe154def4ea18b9e9f66cc4eac5a63db849d95eec0bfbb49e50f1fa489c594150000e8343ad3a4da

    • SSDEEP

      98304:DRTnXmjYGbSaZucU4dciig/va6x0r1m8PfNlLriCvGrF:DRZGButA/iga5rQ8PfNlqCvGrF

    Score
    10/10
    privateloaderevasionloaderspywarestealerthemida

    • Modifies firewall policy service

      evasion

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral15behavioral16

    • Target

      updates/icudtl.dat

    • Size

      9.8MB

    • MD5

      65c6337820fbe9bf2498a9395e3b20f2

    • SHA1

      5cc62646e6c73b4be276d08719bc5e257af972bb

    • SHA256

      33da1cdda18eaea52011d40ae9a610cac9f6466156e9803891ee77294607aee4

    • SHA512

      4800f03577a46a98a4bd786dc37a380f4169540e243fdb7835e3146fba0d0e1d07a7e3ec8cd23566feb00d204d582d678698ae61db156339fe56229de0b267c9

    • SSDEEP

      196608:g7UPty2ACLA2cliXUxR0jHz93Whl96p6VJQ:V12CLAZliXUxR0jHz93Whl96p6VJQ

    Score
    3/10
    behavioral17behavioral18

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

4
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks