Overview

overview

7

Static

static

3

theif.exe

windows7-x64

7

theif.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    theif.exe

  • Size

    20.9MB

  • Sample

    230204-xxrjeaec38

  • MD5

    60b946877ef1b74c508aa163c442162c

  • SHA1

    1971af2feec5c2c26ec60c5c9a8d600d8c41ac71

  • SHA256

    fbc7270e46dccaae9cc0c07441d5c5248463e237845a8334241147182b2f618c

  • SHA512

    9b6f3ab377e743122c80dd84fb146a28fe87b1bd21cd7475839ca32b558b8c05b967d273f78fb311a63016c7b58ad9062d196702aca747632daaea84de17f57e

  • SSDEEP

    393216:VhoVRsiaZS9dM/ISWdQ2lH/m3pI+9J5eX/H4i5/Z4JH3qXeSI:VhoHsiakT6ISWdQ0KX9J5eX/Y/a

Score
7/10
pyinstallerspywarestealer

Malware Config

Targets

    • Target

      theif.exe

    • Size

      20.9MB

    • MD5

      60b946877ef1b74c508aa163c442162c

    • SHA1

      1971af2feec5c2c26ec60c5c9a8d600d8c41ac71

    • SHA256

      fbc7270e46dccaae9cc0c07441d5c5248463e237845a8334241147182b2f618c

    • SHA512

      9b6f3ab377e743122c80dd84fb146a28fe87b1bd21cd7475839ca32b558b8c05b967d273f78fb311a63016c7b58ad9062d196702aca747632daaea84de17f57e

    • SSDEEP

      393216:VhoVRsiaZS9dM/ISWdQ2lH/m3pI+9J5eX/H4i5/Z4JH3qXeSI:VhoHsiakT6ISWdQ0KX9J5eX/Y/a

    Score
    7/10
    spywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks