Overview
overview
10Static
static
102222-main/Build.exe
windows7_x64
102222-main/Build.exe
windows10_x64
102222-main/...se.dll
windows7_x64
12222-main/...se.dll
windows10_x64
12222-main/OTC.dll
windows7_x64
12222-main/OTC.dll
windows10_x64
12222-main/OTC2.dll
windows7_x64
12222-main/OTC2.dll
windows10_x64
12222-main/aurora.dll
windows7_x64
12222-main/aurora.dll
windows10_x64
12222-main/...ty.dll
windows7_x64
12222-main/...ty.dll
windows10_x64
32222-main/gan.exe
windows7_x64
102222-main/gan.exe
windows10_x64
102222-main/mySThe.exe
windows7_x64
102222-main/mySThe.exe
windows10_x64
102222-main/myporno.exe
windows7_x64
102222-main/myporno.exe
windows10_x64
82222-main/pandora.dll
windows7_x64
12222-main/pandora.dll
windows10_x64
102222-main/pass.exe
windows7_x64
102222-main/pass.exe
windows10_x64
102222-main/petya.exe
windows7_x64
62222-main/petya.exe
windows10_x64
62222-main/sheyhST.exe
windows7_x64
102222-main/sheyhST.exe
windows10_x64
102222-main/...io.exe
windows7_x64
102222-main/...io.exe
windows10_x64
72222-main/test.exe
windows7_x64
32222-main/test.exe
windows10_x64
32222-main/token.exe
windows7_x64
62222-main/token.exe
windows10_x64
6Analysis
-
max time kernel
25s -
max time network
79s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-07-2021 07:53
Behavioral task
behavioral1
Sample
2222-main/Build.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2222-main/Build.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
2222-main/NanoSense.dll
Resource
win7v20210410
Behavioral task
behavioral4
Sample
2222-main/NanoSense.dll
Resource
win10v20210410
Behavioral task
behavioral5
Sample
2222-main/OTC.dll
Resource
win7v20210408
Behavioral task
behavioral6
Sample
2222-main/OTC.dll
Resource
win10v20210410
Behavioral task
behavioral7
Sample
2222-main/OTC2.dll
Resource
win7v20210408
Behavioral task
behavioral8
Sample
2222-main/OTC2.dll
Resource
win10v20210410
Behavioral task
behavioral9
Sample
2222-main/aurora.dll
Resource
win7v20210408
Behavioral task
behavioral10
Sample
2222-main/aurora.dll
Resource
win10v20210410
Behavioral task
behavioral11
Sample
2222-main/fatality.dll
Resource
win7v20210410
Behavioral task
behavioral12
Sample
2222-main/fatality.dll
Resource
win10v20210408
Behavioral task
behavioral13
Sample
2222-main/gan.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
2222-main/gan.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
2222-main/mySThe.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
2222-main/mySThe.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
2222-main/myporno.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
2222-main/myporno.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
2222-main/pandora.dll
Resource
win7v20210408
Behavioral task
behavioral20
Sample
2222-main/pandora.dll
Resource
win10v20210410
Behavioral task
behavioral21
Sample
2222-main/pass.exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
2222-main/pass.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
2222-main/petya.exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
2222-main/petya.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
2222-main/sheyhST.exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
2222-main/sheyhST.exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
2222-main/stpastio.exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
2222-main/stpastio.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
2222-main/test.exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
2222-main/test.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
2222-main/token.exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
2222-main/token.exe
Resource
win10v20210410
General
-
Target
2222-main/sheyhST.exe
-
Size
1.0MB
-
MD5
a339a377abbfb9c0ee85652901cc67b3
-
SHA1
cbafbcefd502b16d4661a2da17fc6d04b34ee0cb
-
SHA256
0a0a341eb3849788273e62d2acd28de82942f01396c7543f85a5b8a8420e0c44
-
SHA512
a43ae5d6cf03c96ae757bdb97521562c64e7248d73791ecfae1498df4e9b7401d359bba5e56a3ba2c16cc0e6f30cfc6b9c421667353cb4677b98977c0082282d
Malware Config
Signatures
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 7 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
sheyhST.exepid process 628 sheyhST.exe 628 sheyhST.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sheyhST.exedescription pid process Token: SeDebugPrivilege 628 sheyhST.exe