Overview

overview

10

Static

static

10

jeammah5_b...in.dll

windows7-x64

8

jeammah5_b...in.dll

windows10-2004-x64

8

Resubmissions

22-09-2022 16:56

220922-vfw2fsbhg6 10

22-09-2022 16:47

220922-vaqbqabhf5 8

09-09-2022 00:00

220909-aab4wagbf3 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jeammah5_beget_tech.bin.dll

  • Size

    2.7MB

  • Sample

    220922-vfw2fsbhg6

  • MD5

    252d06bd87a3287e88b25b5686820dc5

  • SHA1

    85c2ec0d59900331c61731fec723004544ce6796

  • SHA256

    ec3888e4031b443d7eed51bb3bd9d51207acc90cc60c49270e43724b059b7f63

  • SHA512

    ccec9571a08eefc7e611458635cb5aec47c8f74e914b9661002611dbb20a96a16a3442793472a7f95672353f36b215f90b658ae60184779af50fe5ac99468e0a

  • SSDEEP

    49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYce2ek:P1Kqvv07noI7lOOYcK

Score
10/10
erbiumspywarestealer

Malware Config

Extracted

Family

erbium

C2

http://77.73.133.53/cloud/index.php

Targets

    • Target

      jeammah5_beget_tech.bin.dll

    • Size

      2.7MB

    • MD5

      252d06bd87a3287e88b25b5686820dc5

    • SHA1

      85c2ec0d59900331c61731fec723004544ce6796

    • SHA256

      ec3888e4031b443d7eed51bb3bd9d51207acc90cc60c49270e43724b059b7f63

    • SHA512

      ccec9571a08eefc7e611458635cb5aec47c8f74e914b9661002611dbb20a96a16a3442793472a7f95672353f36b215f90b658ae60184779af50fe5ac99468e0a

    • SSDEEP

      49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYce2ek:P1Kqvv07noI7lOOYcK

    Score
    8/10
    spywarestealer

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks