Extracted

• • Target
    OkEgjVmQ0rPYTjBDwBy70NyH.exe
  • Size 1.8MB
  • SHA256 d654c6c1643997b6c6d8e8133e867e52c3176f3e6ed3827ea5f4e29023817115
  • MD5 53074ccaf36bc24fd4286062f0cdac98
  • SHA1 2ca97c4d5dfacfc29d8feee90cd7de2eff651225
  • SHA512 4a47f2fad7dcf2fefb8fd4ed2714b90f13b4cfec755521db27fb131fce068168f31e1edb0d2dc7f5eb867f992063a37ce5022e7a8a894f906fc91ed1c1be6ef5
  • MD5 SHA1 SHA512

  Score

  8^/10

  spywarestealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Osz8mRDYP0laXozOTuxyUiiF.exe
  • Size 1.4MB
  • SHA256 3e34092ce27276c1b0cdeba1d3f8649258e55f23dfb92fcd9de6d52d5f559e91
  • MD5 0f01bbed1d28eba69835962f39d15261
  • SHA1 5538f0cc1959b565277060c53d2f5e4d633ed899
  • SHA512 442a815bc696cdd57bd141565c0ccf983ff9d241129a4bd6ed19d629fd60a5207501abf3ef5c6f19e6e6eab79fc27059f04664809e7572173d3621a2bfb4436d
  • MD5 SHA1 SHA512

  Score

  10^/10

  socelarsdiscoveryspywarestealer

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral3behavioral4
• • Target
    rUtfalBbvXy6eEmMrseqpFHx.exe
  • Size 2.0MB
  • SHA256 c6ac7d4850131a5422da8170ed1a51f939c4b3b1f312478498e8aa7df374e840
  • MD5 93156ea35c0014003d9e87bf82a79b33
  • SHA1 1eacd5ec484996a4dab233cd569c54d1594fb3a9
  • SHA512 024611682daf2ca96112253d1b2cf8afed22639363c9684353a89e396a89e032a4f7ce8236557416e27dd635e3ee82b332aa3e0bfeba0affc439bdd28a3ea322
  • MD5 SHA1 SHA512

  Score

  9^/10

  spywarestealer

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6