Overview

overview

10

Static

static

10

Whiteout G...ed.dll

windows10_x64

1

Whiteout G...ut.exe

windows10_x64

7

Whiteout G...64.exe

windows10_x64

8

Whiteout G...86.exe

windows10_x64

8

Resubmissions

16-11-2021 20:05

211116-ytx3fsccdk 10

16-11-2021 20:03

211116-ys69qsfch2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Whiteout_GhostClient_Cracked_All_Bypass_2021.rar

  • Size

    27.3MB

  • Sample

    211116-ys69qsfch2

  • MD5

    11fb7f359717b79421e6b56007f234e1

  • SHA1

    0a331701cb8e37bdfb4ba9012dbd2ab0b6a42450

  • SHA256

    37e3b28d98736c416eaa70b8e674ccc676292500642f41d9ff3f46252dc3ce35

  • SHA512

    d9a5844736e1e9575d43bbfeb7b73c2bb703d75b2e9c86d08b044995e57254587a601deb56c8751d8163767c04fc03d6f333e7c4f163dd6ca1bb0fd765d8d52f

Score
10/10
pyinstallerspywarestealertrojan

Malware Config

Targets

    • Target

      Whiteout GhostClient Cracked (All Bypass) 2021/Whiteout vX Cracked/Whiteout vX Cracked.dll

    • Size

      4.3MB

    • MD5

      aa6eed97f7877abb9f3396e0c4eec706

    • SHA1

      abe788bb8c682d08264200275abeb0a26a905a5b

    • SHA256

      04a9518cf09ad09c42647b2f2d3036f3fcfd59a36850a6ef56359fcc11ad1456

    • SHA512

      4a5186414fe9a1e577d5724d1f72d0a1c3441d2172b02cbb0f20bd803a997af5a98ec30f87948f3eb426c5d63b96a75ad3c510529e0eb3ab7f34eefd1d7eb605

    Score
    1/10
    behavioral1

    • Target

      Whiteout GhostClient Cracked (All Bypass) 2021/Whiteout vX Cracked/Whiteout.exe

    • Size

      13.5MB

    • MD5

      19542b787bc19a1dbc551782c055efc4

    • SHA1

      803f21c2eb18367f8ffe9568a2bf2c3618d62b92

    • SHA256

      333fa9832e368506d04a7a634d30bf352689ddecdbadad415102816d1931c3e6

    • SHA512

      02008d99a13c2ef419518e3d2845c53e9a60b9aaca87e328058613606a6fb61d9bcbd55cfe09fb522643d726b787f7711362a0b92158e50341908ed7619d81e9

    Score
    7/10
    spywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral2

    • Target

      Whiteout GhostClient Cracked (All Bypass) 2021/_Redist/vcredist_x64.exe

    • Size

      5.5MB

    • MD5

      630d75210b325a280c3352f879297ed5

    • SHA1

      b330b760a8f16d5a31c2dc815627f5eb40861008

    • SHA256

      b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023

    • SHA512

      b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f

    Score
    8/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral3

    • Target

      Whiteout GhostClient Cracked (All Bypass) 2021/_Redist/vcredist_x86.exe

    • Size

      4.8MB

    • MD5

      b88228d5fef4b6dc019d69d4471f23ec

    • SHA1

      372d9c1670343d3fb252209ba210d4dc4d67d358

    • SHA256

      8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8

    • SHA512

      cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8

    Score
    8/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks