Overview

overview

7

Static

static

3

Silent Cli....8.exe

windows7-x64

7

Silent Cli....8.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

Silent Client.exe

windows7-x64

1

Silent Client.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.js

windows7-x64

3

resources/app.js

windows10-2004-x64

3

resources/...r.html

windows7-x64

1

resources/...r.html

windows10-2004-x64

1

resources/...ter.js

windows7-x64

3

resources/...ter.js

windows10-2004-x64

3

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Silent Client Setup 4.1.8.exe

  • Size

    69.9MB

  • Sample

    240701-b6fydawbmp

  • MD5

    dd58133822b647900e4c7af89354ffc4

  • SHA1

    cd13b9380d6cb6176462699422e803b8de98bee3

  • SHA256

    c894729f6186bcac39c9c627a2634a7a3896e55a626db17a086daded78f6fa77

  • SHA512

    32112f85a0326c3bcd6c33810679a54d228ab53caa1e6c018ae25f5ee62da56d276c6e56ce8f888dade04bc9a99b4beb3b8ed10f076a237ebd46a45068e8d768

  • SSDEEP

    1572864:k2njRkJ7cQwKJV6fwn3Hi0MoXGeLxwTR5Tlpl+YfYVD9bIHIjKshvOWUMT+J:kWRdQ9JVj33MG3STzRpQYfKD1jJ2FMTi

Score
7/10
discoveryexecution

Malware Config

Targets

    • Target

      Silent Client Setup 4.1.8.exe

    • Size

      69.9MB

    • MD5

      dd58133822b647900e4c7af89354ffc4

    • SHA1

      cd13b9380d6cb6176462699422e803b8de98bee3

    • SHA256

      c894729f6186bcac39c9c627a2634a7a3896e55a626db17a086daded78f6fa77

    • SHA512

      32112f85a0326c3bcd6c33810679a54d228ab53caa1e6c018ae25f5ee62da56d276c6e56ce8f888dade04bc9a99b4beb3b8ed10f076a237ebd46a45068e8d768

    • SSDEEP

      1572864:k2njRkJ7cQwKJV6fwn3Hi0MoXGeLxwTR5Tlpl+YfYVD9bIHIjKshvOWUMT+J:kWRdQ9JVj33MG3STzRpQYfKD1jJ2FMTi

    Score
    7/10
    discoveryexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/SpiderBanner.dll

    • Size

      9KB

    • MD5

      17309e33b596ba3a5693b4d3e85cf8d7

    • SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

    • SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

    • SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • SSDEEP

      192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

    Score
    1/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral10behavioral9

    • Target

      LICENSES.chromium.html

    • Size

      6.5MB

    • MD5

      180f8acc70405077badc751453d13625

    • SHA1

      35dc54acad60a98aeec47c7ade3e6a8c81f06883

    • SHA256

      0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c

    • SHA512

      40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec

    • SSDEEP

      24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj

    Score
    1/10
    behavioral11behavioral12

    • Target

      Silent Client.exe

    • Size

      154.5MB

    • MD5

      c73af0fda3ea1acb59a3939bb160bc9c

    • SHA1

      9cee51f3b083046dec72e8611e7e6f1f4c3adc9b

    • SHA256

      0e362df58c4293c13334e4624eca23f1f6a4957b331ab88cf02e2e224951ebff

    • SHA512

      f0df2e78076f968bde2ffc92331407eb25b50d38145c9144bf66124d3aea9086062a35ec4b18a91ac96a6a3fcac79f837163f3b403ffd4a0c5acae13663b6844

    • SSDEEP

      1572864:kH3tCV62ipzpxI9Sua3nkTOFqXagQB3zR+KRkdW0v8KEtL2kTbwo7XWyHz15Dods:JFUFdBjIK/YW9x

    Score
    7/10
    execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral13behavioral14

    • Target

      d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      cb9807f6cf55ad799e920b7e0f97df99

    • SHA1

      bb76012ded5acd103adad49436612d073d159b29

    • SHA256

      5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

    • SHA512

      f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

    • SSDEEP

      49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI

    Score
    1/10
    behavioral15

    • Target

      ffmpeg.dll

    • Size

      2.7MB

    • MD5

      37d1c1e89282be8852d443cf51f629b7

    • SHA1

      bf80d5df917ffbaf5db44512fb195d99036b54ec

    • SHA256

      8d22431f42e8e258eba762835e425bab3532bfc7b6a5743b6feea7063d61ca63

    • SHA512

      daf674f7be70d783338ff0df16f5e61a7661ab9abfcee9a0a5bd29cc35d8ee5f03825be77760a2ce334ba099361b7394bf3ad8684ad980ff7a8169c921619118

    • SSDEEP

      49152:IMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3C:q3Kk76fUq/4TagreBOirnW

    Score
    1/10
    behavioral16behavioral17

    • Target

      libEGL.dll

    • Size

      468KB

    • MD5

      6dff2f3923b2de2258cef0399e7a807d

    • SHA1

      fc3679476c88113d5ff6589784e7fc1be5c72d17

    • SHA256

      eb7583831a87d12390cad7f1e967f7637b588c67f51ecd8f8b996fc01fe65b19

    • SHA512

      9590d369d248876be8cf3ba8142ad8e3982620fcadc8fe64490a36a9e4e6c3dc2a96a7f897fe1b99aea293bf16b2662ceabbb4f8b74e14c510f24825ee0aa4d3

    • SSDEEP

      12288:Pu0LAjbIkyVVR8O9v/6TiT5eU3axzv1wo:Pub49/6TiQzv1X

    Score
    1/10
    behavioral18behavioral19

    • Target

      libGLESv2.dll

    • Size

      7.2MB

    • MD5

      11afd816065727c388c9331f5a9d5170

    • SHA1

      fd6c86434ccc3aed6502003907aad8a9bbed9064

    • SHA256

      d1209f7f8fb2fe08ea5c6fbf2be4a38704355b5b384bdb66b299def91be177ce

    • SHA512

      7104c8fa85e47f16a2a9dd32a7ea3282cee114b64fbf03d18de7fdd0bfcebc0bdfa564f61e1f016a59c6e6510ca09988414e8f093ac4c5eec89829ee8545994a

    • SSDEEP

      98304:kuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMld:kuDPTwLap14QzEijsvd

    Score
    1/10
    behavioral20behavioral21

    • Target

      resources/app.asar

    • Size

      5.8MB

    • MD5

      b2fbdebf6e0bec1d19db524c6476e2bc

    • SHA1

      b4167a09dcfbdeff2547d02786a97a345a35b20a

    • SHA256

      8e6dfd71826cc8e50da50279ee872466840d45f8593424edbf4698a0b5fd7244

    • SHA512

      24802b1d67c179e7d0ffce000494897761755156f2b626f4c3ecc11dd33ba14c1b84e2cb19884495e5735d58d6ca2e2371c0d8f781f6a2bd1e2d2a5ab9591db8

    • SSDEEP

      98304:InJ1orWxUrKym/SpmREGPiOzZx3GcDTyKpv0Y4nrnV5yCvy:Inz4rU/iOzacF03vy

    Score
    3/10
    execution
    behavioral22behavioral23

    • Target

      resources/assets/updater/updater.html

    • Size

      423B

    • MD5

      80ca9f9545a5cb816ec202c5ac7cc6d8

    • SHA1

      383035241b86667aa8cc192d675706974e89eeef

    • SHA256

      6ab2c4f63e9c6fb6b29315b9a0909f0977d935e61027603dc4773f1f673848ab

    • SHA512

      a78d8c9ae1cc2e40a113c1843bb03efe7a09ab1125338681a580bf2457efa582a3c4c72c61b3a3e06849d9fe200a2005648ac8276533f583abf7fe03eb8a786a

    Score
    1/10
    behavioral24behavioral25

    • Target

      resources/assets/updater/updater.js

    • Size

      606B

    • MD5

      83b1bf75fece90a4c4c38666c825446a

    • SHA1

      b84e504367405feeef33d136d7b6e5f43cbcd8aa

    • SHA256

      8f27a967789167ec390e233e30dfb140cc0db66260fa786e725b074402a4621d

    • SHA512

      d5808d242367151f7fab672313f9ac4f976a4f437b9f9a8b441f0322cc1cde922a74ef9f82ad2200bafd6793b270f6382ff858dd51e67ab7f9c363a76202277b

    Score
    3/10
    execution
    behavioral26behavioral27

    • Target

      resources/elevate.exe

    • Size

      105KB

    • MD5

      792b92c8ad13c46f27c7ced0810694df

    • SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

    • SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    • SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • SSDEEP

      3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

    Score
    1/10
    behavioral28behavioral29

    • Target

      vk_swiftshader.dll

    • Size

      5.0MB

    • MD5

      c3910a9fed38daf90b54b78ba39d0d40

    • SHA1

      6e702fdea3d2989aadab102a2da6d3005cc135d2

    • SHA256

      4a9ca5adbfdb3fd2cee0be0cef83ad21bfd8239d8ea0f8ef9849b8cf879d2d02

    • SHA512

      65b72e9a209ead1a43344731163f39a3d05952b219c8bcc720d1256cc8adfadf938055a322ea951bf1a40172e12809fd487937a20df0c67d0497f671e1626ba0

    • SSDEEP

      49152:eG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAt:b7iDPqjvzO1Lhgf49zT7grg4

    Score
    1/10
    behavioral30behavioral31

    • Target

      vulkan-1.dll

    • Size

      899KB

    • MD5

      9fdd70361cc0dcf3fda2020cad415b94

    • SHA1

      94b6329920e8a70c5dca2d807401440ebea3e96a

    • SHA256

      43b0db2ecb8147f6183021243f8cf233367c2689b601252834c20690ad092c97

    • SHA512

      12214d8fc2af9ffac9dfa52eda2965e12a8f657eada8e70ff473a8c0d4f345e44740c0550d4f462ecec758ddb635d781368e9cf5f19098ff0eea872cf1a9db1a

    • SSDEEP

      24576:IR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:IR1l1culw6Z5WUDYsH56g3P0zAk7

    Score
    1/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

PowerShell

2
T1059.001

JavaScript

2
T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

execution
Score
7/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

execution
Score
7/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10