Overview

overview

10

Static

static

10

fb2aef6ff2...1a.exe

windows7_x64

10

fb2aef6ff2...1a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin

  • Size

    120KB

  • Sample

    220216-n7pm5achfq

  • MD5

    8950fcf3617883788286cc40cc8665f5

  • SHA1

    b169be225703daefcf7d236893ae55b5cc774dbd

  • SHA256

    fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a

  • SHA512

    ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3

Score
10/10
allcomestealersuricata

Malware Config

Extracted

Family

allcome

C2

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=infected

Wallets

DJTEj1dHbvRbzRMFswkBbEoVtYyDX4utrm

r9ZdXujmStGh4xJ45FXAYiz6vLeF12ft4H

GBPA3M5TJHPBUY33MFFNTSFHGQEV27P2SP7NCGK5ZZXINCNMXFYO4C5L

48J7NrfRFCPFfwyHaywQUSKuyn56or1kRByicvx2ZCFMRboGDmvxH9y4kQz6T2Hhv8AREnZE4dS43JoVcrkc4kShNTkXbv8

qp4cn8t095hphpy6qraafmtsfskjnnxevcvvug8e87

bc1q2phs6h42kfecv9eu2vm9qjspmtw8w0256eg8cc

0x7942b7173F1557F285666009006Bff1AEe1339B3

LdCE37gd4AgqxAyjMjc4NYdZNT2nn1qpen

Targets

    • Target

      fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin

    • Size

      120KB

    • MD5

      8950fcf3617883788286cc40cc8665f5

    • SHA1

      b169be225703daefcf7d236893ae55b5cc774dbd

    • SHA256

      fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a

    • SHA512

      ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3

    Score
    10/10
    allcomestealersuricata

    • Allcome

      A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

      stealerallcome

    • suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

      suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks