Overview

overview

10

Static

static

3

svchost.bin.exe

windows11_x64

10

svchost.bin.exe

windows10_x64

10

svchost.bin.exe

windows10_x64

10

Resubmissions

04-09-2021 07:37

210904-jf39zshben 10

04-09-2021 07:35

210904-jeq82aeab3 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.bin.zip

  • Size

    6.5MB

  • Sample

    210904-jf39zshben

  • MD5

    5224c529a6e9ebe343ab37ad8ba99d86

  • SHA1

    056935a88a4877b30ad74ddf2e2c838d0d5b1faf

  • SHA256

    591bf6c785a42e2ad6c91e94c544e69e68a0484acd47c1b1747b49d8fb1b3d11

  • SHA512

    4b5c2d5d8e5a0b65490c0999e4bca11836d5e75992906fa929b3ff3131b546449ddef5de697a124b0bc4b8a83e1a682db2d487e25193acda7af47f76115bf3f6

Score
10/10
beapyminerpyinstallerspywarestealersuricataworm

Malware Config

Targets

    • Target

      svchost.bin

    • Size

      6.6MB

    • MD5

      2787bb2d1ab223f8ac2692f3a8fd85fc

    • SHA1

      dc34ee4e46ddea333cdc90e4aad7589cb8ee1ea0

    • SHA256

      952e3e059251cd41e3c67006c5aa4b75fe3e6b0f18d96554b2d60d4ccfb78cb4

    • SHA512

      d79bd7599ccb09fa72b939a506d04e28cb958e59c3987ab4d375e76337d5b1e33369d59397338aaeaf938c14ec9d93b20501d5224d151631c69c874d0657e9f3

    Score
    10/10
    beapyminersuricatawormspywarestealer

    • Beapy

      Beapy is a python worm with crypto mining capabilities.

      minerwormbeapy

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata

    • suricata: ET MALWARE Py/Beapy CnC Checkin

      suricata: ET MALWARE Py/Beapy CnC Checkin

      suricata

    • suricata: ET MALWARE Win32/Beapy CnC Domain in DNS Lookup

      suricata: ET MALWARE Win32/Beapy CnC Domain in DNS Lookup

      suricata

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Account Manipulation

1
T1098

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks