Overview

overview

10

Static

static

10

fb2aef6ff2...1a.exe

windows7_x64

10

fb2aef6ff2...1a.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin
  • Size 120KB
  • Sample220216-n7pm5achfq
  • SHA256 fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
  • MD5 SHA1 SHA512
Score
10/10
allcomestealersuricata

Malware Config

Extracted

Family

  • allcome

C2

  • http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=infected

Wallets

  • DJTEj1dHbvRbzRMFswkBbEoVtYyDX4utrm

  • r9ZdXujmStGh4xJ45FXAYiz6vLeF12ft4H

  • GBPA3M5TJHPBUY33MFFNTSFHGQEV27P2SP7NCGK5ZZXINCNMXFYO4C5L

  • 48J7NrfRFCPFfwyHaywQUSKuyn56or1kRByicvx2ZCFMRboGDmvxH9y4kQz6T2Hhv8AREnZE4dS43JoVcrkc4kShNTkXbv8

  • qp4cn8t095hphpy6qraafmtsfskjnnxevcvvug8e87

  • bc1q2phs6h42kfecv9eu2vm9qjspmtw8w0256eg8cc

  • 0x7942b7173F1557F285666009006Bff1AEe1339B3

  • LdCE37gd4AgqxAyjMjc4NYdZNT2nn1qpen

Targets

    • Target
      fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin
    • Size 120KB
    • SHA256 fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
    • MD5 SHA1 SHA512
    Score
    10/10
    allcomestealersuricata

    • Allcome

      A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

      stealerallcome

    • suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

      suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks