eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610

Sharing

Copy URL

Twitter E-mail

General

Target

EasyMC_Setup_v1.6.14_x64.exe
Size

61.3MB
Sample

240702-1hm48a1bnc
MD5

3d34ef77549c696aa25ad60924afb265
SHA1

6989a37c8691475c60293251ef6ed743ac54637b
SHA256

eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610
SHA512

91e115ff7023982e0c00436fbffd2f84a5ccb86244f67bf92758e1577ddc006b7e7d0a1cd33e434f19158f6fc696d40cceb050a9cd2bf39188ad226727ee99a5
SSDEEP

1572864:eV1g0aTp2uRPflkYr+p5N/2QWSuUPTZYfD2:eV1haTp20CYI/HWfUbZSC

Score

8^/10

Malware Config

Targets

- Target
  
  EasyMC_Setup_v1.6.14_x64.exe
- Size
  
  61.3MB
- MD5
  
  3d34ef77549c696aa25ad60924afb265
- SHA1
  
  6989a37c8691475c60293251ef6ed743ac54637b
- SHA256
  
  eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610
- SHA512
  
  91e115ff7023982e0c00436fbffd2f84a5ccb86244f67bf92758e1577ddc006b7e7d0a1cd33e434f19158f6fc696d40cceb050a9cd2bf39188ad226727ee99a5
- SSDEEP
  
  1572864:eV1g0aTp2uRPflkYr+p5N/2QWSuUPTZYfD2:eV1haTp20CYI/HWfUbZSC
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  7zip/linux/x64/7za
- Size
  
  1.4MB
- MD5
  
  6a2e4039a2f56265369f22ecb1a19fd5
- SHA1
  
  b0ea59484a4827d7d9a0a27a5270310ef07e61a8
- SHA256
  
  afc9448bd0cc2eeda131cce313ef4994f9656417e0a15c8465fcda9ca859b280
- SHA512
  
  796188635271cbd7dbd6a7f37cb4d4d5b394c8a302dc62008c40b4be507382925eeb8a550ca11e81c791d5dbda238f95dedecbdd0daddf84907c4fa3a9b1ca59
- SSDEEP
  
  24576:Z3qW/EbABBtyz89OfxvH7WlwAMEd2rZXTN9H8lBFwEP:Z3zEbO3a7ucjN9HUwE
Score

4^/10
behavioral11
- Target
  
  7zip/mac/x64/7za
- Size
  
  2.8MB
- MD5
  
  335361d7f6faf13cadbf116bfdb97226
- SHA1
  
  d6cba0f2e221d1061261767ec38ddd7c550015a3
- SHA256
  
  434075f6ff5ea9250571033ca06b95d464efcad87a528dd0b224816c86b1a444
- SHA512
  
  5fa86f6ec50e0f2fa87ec7cfa0e98cf2bfe158035e5af024e017cce4ddb33aea631008e43328e6049e0f95e8c63dac8b1e03d3c949b34ad2a3e94ab979cad0e0
- SSDEEP
  
  49152:VxV0AtX4EEf/Gf80I+qnyVUdbU1t4t1zCtmf3ybzh2uI1I+wwBV2Lg800h/E2zz8:Vf54EEf/Th0VEHf3yb5U0h/ELGCTZ5
Score

1^/10
behavioral12
- Target
  
  7zip/win/ia32/7za.exe
- Size
  
  773KB
- MD5
  
  dfd1cf824c781069def1d239a626d43e
- SHA1
  
  bbe24cbae89166de829a7cf91eebfb518d8f45be
- SHA256
  
  31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
- SHA512
  
  0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20
- SSDEEP
  
  24576:fq79Al2Gp6BXGyja9hicoZ6ijJhyHiJT:yS2WUda9vy3dT
Score

1^/10
behavioral13 behavioral14
- Target
  
  7zip/win/x64/7za.exe
- Size
  
  1.2MB
- MD5
  
  b7b7473472c9806bee3e7ae6c1adda23
- SHA1
  
  2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
- SHA256
  
  b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
- SHA512
  
  544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
- SSDEEP
  
  24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
Score

1^/10
behavioral15 behavioral16
- Target
  
  EasyMC Launcher.exe
- Size
  
  133.1MB
- MD5
  
  e311796a24989bf6785699a2d3b482c2
- SHA1
  
  e07b67cdcd393e558b94f9b8800361b69b4d1228
- SHA256
  
  e65265cd415da534eb3984e50aec17f83596d6a37e7345f165e90fe788027b77
- SHA512
  
  e52dc0f12da63f025f52fbfd32a2d52c596b50fca40535d8e783e844df60f5e01fbc0c770956bbe5825063453d090b80fd6af5197c1b74c375c77c272f698ff7
- SSDEEP
  
  1572864:52HVo9Ck+yOBBdJAVwlymAETslfp409t:x9Ctx3tu
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  
  LICENSES.chromium.html
- Size
  
  5.2MB
- MD5
  
  4247afa6679602da138e41886bcf27da
- SHA1
  
  3bb8c83dc9d5592119675e67595b294211ddbf6e
- SHA256
  
  bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
- SHA512
  
  ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
- SSDEEP
  
  12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4
Score

1^/10
behavioral19 behavioral20
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral21
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  7977f3720aa86e0ec2ad2de44ad42004
- SHA1
  
  04a4ef5ccd72aa5d050cc606a7597a3b388c6400
- SHA256
  
  61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e
- SHA512
  
  8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d
- SSDEEP
  
  49152:baOoZks54czfQNk9GSQABmZuZgAp1iJxgG1broIhj4OxSZpSq:it59uEBm8geZz
Score

1^/10
behavioral22 behavioral23
- Target
  
  hostsremover/EasyMCHostsRemover.exe
- Size
  
  13KB
- MD5
  
  dff1888306d5036e9e831d62d16412ab
- SHA1
  
  2597f86a16af51f61f7b4754fe290a9969e85abe
- SHA256
  
  136b6ddebbd837f775a10425fc0a6eaf4a46d32473f372208873cfeb2f64a28a
- SHA512
  
  c2f984340c6d01531151b6ff58d2e5b47740b3faf309bc28c6349c4dd2b1e8715e24a69ee238380bd3ffc52e7922cf6c9a0c1ab685f449dc7e13054383b1de62
- SSDEEP
  
  192:wRT2kZJ9fs4yjyjLwxx/VUXfIF8KYc3qvUjaMmk/m:wRTd5fs4yGAx/V4fIFlYc3qsU0
Score

8^/10
- Drops file in Drivers directory
behavioral24 behavioral25
- Target
  
  libEGL.dll
- Size
  
  431KB
- MD5
  
  7b77074945dfe5cf0b1c5a3748058d57
- SHA1
  
  fdea507ac2be491b8ad24ddc1030ea9980c94c0d
- SHA256
  
  994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56
- SHA512
  
  d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd
- SSDEEP
  
  6144:QpKolEK3EyQVAZvhnzGtMY+3lnLdYcUpwOXW4IUo+lTsRLVDc2/:QBl1EyyAZvJWM936wOJTWVDc
Score

1^/10
behavioral26 behavioral27
- Target
  
  libGLESv2.dll
- Size
  
  7.6MB
- MD5
  
  8c93e19281992a00993fc0f09e272917
- SHA1
  
  3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7
- SHA256
  
  1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703
- SHA512
  
  c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c
- SSDEEP
  
  49152:BIgJiNu/CVyS4I+K/UGG7ftgIj4RBrGW+T54vwjKxH33yjsMfRJvLnLBXonnMl9W:mNyUxGDahRNR6gyxQi4Mn0YJ4/qamG
Score

1^/10
behavioral28 behavioral29
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral30 behavioral31
- Target
  
  swiftshader/libEGL.dll
- Size
  
  445KB
- MD5
  
  be1b6fe26a1b5a3e1302c26ce5ce53f3
- SHA1
  
  c3cac08e89c4cc91eae1cc87e33a1dea723f1d78
- SHA256
  
  162abe61314e720384d8cdd43190a89df8a96de52f3ede7b6c58998f615d8546
- SHA512
  
  07dca111391dfb6b7e90d4be02071bc625128eeca0b9d9a3cebdc7916baec9f95cbbf906f2533befd6b62b9bbc69488ffa720f8d40c9710dd3b7d540d9dcaa55
- SSDEEP
  
  6144:NldwaUBIAHXboKn7YsGfJjjvQppfSH6RdW8wrpGLVgf8q:JWIsXboKnMAfSHChgUq
Score

1^/10
behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Drops file in Drivers directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32