Overview

overview

10

Static

static

Jack Move.exe

windows7_x64

1

Jack Move.exe

windows10-2004_x64

7

freebl3.dll

windows7_x64

1

freebl3.dll

windows10-2004_x64

4

mozglue.dll

windows7_x64

3

mozglue.dll

windows10-2004_x64

10

msvcp140.dll

windows7_x64

3

msvcp140.dll

windows10-2004_x64

10

nss3.dll

windows7_x64

1

nss3.dll

windows10-2004_x64

10

softokn3.dll

windows7_x64

3

softokn3.dll

windows10-2004_x64

10

sqlite3.dll

windows7_x64

3

sqlite3.dll

windows10-2004_x64

10

vcruntime140.dll

windows7_x64

1

vcruntime140.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Steam_DLC.rar

  • Size

    24.9MB

  • Sample

    220219-jh18eaheb8

  • MD5

    d03fab267132f0ddf0bb87349e237889

  • SHA1

    7cbfe52acd5567dce5b067ba7e62a8ceed992c15

  • SHA256

    e4acd60d437bb5558843e74e76630975c7bcc479484bbee595e34b8a2644b082

  • SHA512

    00a3c845581713f1d2ba6bb81aec6d3aeaaacb3dbc7ccb50df314291cdf80e5f34e5581b7a7578d6d5ceca7bafbf69a2a8a4878e95a6f780f91ec2f0937a74bd

Score
10/10
spywarestealer

Malware Config

Targets

    • Target

      Jack Move.exe

    • Size

      80.1MB

    • MD5

      39794b681edd8dfa2c50ddae6d875585

    • SHA1

      8823c542786d6b669946206cdcbd3d7de4698ae6

    • SHA256

      53927686261b37088a9c8ca2e410526c4c2d3aa08414c653da0640a79ba128e8

    • SHA512

      207b3e9f6a145dd477d96dbc4a8a74c441c3981bb922af37ebcfeb94b873145b783887a7920bbc9d60af0015fd5acf88266f76ddaea4716ffd771eb19cf5870c

    Score
    7/10
    spywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

    • Target

      freebl3.dll

    • Size

      326KB

    • MD5

      ef2834ac4ee7d6724f255beaf527e635

    • SHA1

      5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    • SHA256

      a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    • SHA512

      c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

    Score
    4/10
    behavioral3behavioral4

    • Target

      mozglue.dll

    • Size

      133KB

    • MD5

      8f73c08a9660691143661bf7332c3c27

    • SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

    • SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

    • SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral5behavioral6

    • Target

      msvcp140.dll

    • Size

      429KB

    • MD5

      109f0f02fd37c84bfc7508d4227d7ed5

    • SHA1

      ef7420141bb15ac334d3964082361a460bfdb975

    • SHA256

      334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

    • SHA512

      46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral7behavioral8

    • Target

      nss3.dll

    • Size

      1.2MB

    • MD5

      bfac4e3c5908856ba17d41edcd455a51

    • SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

    • SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

    • SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral9behavioral10

    • Target

      softokn3.dll

    • Size

      141KB

    • MD5

      a2ee53de9167bf0d6c019303b7ca84e5

    • SHA1

      2a3c737fa1157e8483815e98b666408a18c0db42

    • SHA256

      43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

    • SHA512

      45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral11behavioral12

    • Target

      sqlite3.dll

    • Size

      630KB

    • MD5

      e477a96c8f2b18d6b5c27bde49c990bf

    • SHA1

      e980c9bf41330d1e5bd04556db4646a0210f7409

    • SHA256

      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    • SHA512

      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral13behavioral14

    • Target

      vcruntime140.dll

    • Size

      81KB

    • MD5

      7587bf9cb4147022cd5681b015183046

    • SHA1

      f2106306a8f6f0da5afb7fc765cfa0757ad5a628

    • SHA256

      c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

    • SHA512

      0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral15behavioral16

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

12
T1012

System Information Discovery

12
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks