Static

static

translator.exe

windows7_x64

10

translator.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    translator.exe

  • Size

    3.5MB

  • Sample

    210111-rasehe9zza

  • MD5

    a7cf97de0e85e78c2e9a78c8c1ffcc8d

  • SHA1

    ec1eb927bfdb0d2696941ee1b4d9f310eabd18e2

  • SHA256

    8351d952377c34ffbbf065f39567dbaf3907af610b5ef77831bcabf154795188

  • SHA512

    c585bacd64ac61019652de6958750e5688d70f52e2635b0e426490a1b189d2d0c21ab4356b675b0589fbe3228c3d1491bc3733b79589a3244c5fa4c900955339

Score
10/10
qulabdiscoveryevasionspywarestealerupx

Malware Config

Targets

    • Target

      translator.exe

    • Size

      3.5MB

    • MD5

      a7cf97de0e85e78c2e9a78c8c1ffcc8d

    • SHA1

      ec1eb927bfdb0d2696941ee1b4d9f310eabd18e2

    • SHA256

      8351d952377c34ffbbf065f39567dbaf3907af610b5ef77831bcabf154795188

    • SHA512

      c585bacd64ac61019652de6958750e5688d70f52e2635b0e426490a1b189d2d0c21ab4356b675b0589fbe3228c3d1491bc3733b79589a3244c5fa4c900955339

    Score
    10/10
    qulabdiscoveryevasionspywarestealerupx

    • Qulab Stealer & Clipper

      Infostealer and clipper created with AutoIt.

      stealerqulab

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks