Overview

overview

5

Static

static

3

UgPhone_in...23.exe

windows7-x64

5

UgPhone_in...23.exe

windows10-2004-x64

5

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

UgPhone.exe

windows7-x64

5

UgPhone.exe

windows10-2004-x64

5

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...m.html

windows7-x64

1

resources/...m.html

windows10-2004-x64

1

resources/...er.exe

windows7-x64

1

resources/...er.exe

windows10-2004-x64

1

resources/...eg.dll

windows7-x64

1

resources/...eg.dll

windows10-2004-x64

1

resources/...ver.js

ubuntu-18.04-amd64

3

resources/...ver.js

debian-9-armhf

4

resources/...ver.js

debian-9-mips

1

resources/...ver.js

debian-9-mipsel

1

resources/...ver.js

windows7-x64

3

Analysis

  • max time kernel
    1s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27-06-2024 05:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js

  • Size

    746B

  • MD5

    a96c382b832ef4371c3bd6abc6a62d2b

  • SHA1

    78d65e8f9009ea3fa438087b7f6b706f5d24cb1c

  • SHA256

    62e2fc5a2ba34b0ab95f9f639908fc736cd0646b1c41ebd28fb5884ff5b26514

  • SHA512

    e28a3ab31f170053ee32188dec07a9714f4c15d742ea7350fb27d18c47d6af6c24523fb4dd3a2adbfde51d4d947ebc19e3032e0e9c6d03006b2a5822df36d8a3

Score
4/10
antivm

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js
    /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js
    1⤵
      PID:741
    • /usr/local/sbin/node
      node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js
      1⤵
        PID:741
      • /usr/local/bin/node
        node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js
        1⤵
          PID:741
        • /usr/sbin/node
          node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js
          1⤵
            PID:741
          • /usr/bin/node
            node /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/chromedriver.js
            1⤵
            • Checks CPU configuration
            • Reads CPU attributes
            • Enumerates kernel/hardware configuration
            • Reads runtime system information
            PID:741
            • /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver
              /tmp/resources/app.asar.unpacked/node_modules/electron-chromedriver/bin/chromedriver
              2⤵
                PID:751

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Virtualization/Sandbox Evasion

            1
            T1497

            Credential Access

            Discovery

            Virtualization/Sandbox Evasion

            1
            T1497

            System Information Discovery

            2
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads