General

  • Target

    generator.exe

  • Size

    18.1MB

  • Sample

    230206-1rhk4abc6v

  • MD5

    50326eb5494a005b977a52e841c92a96

  • SHA1

    caddbc1617aca27b26566864ad08aab63ee7b4a8

  • SHA256

    e55090bd04f0dc4545b9ff2557d0e10e131d0fafb9e7f76ca939837a246af302

  • SHA512

    cc3d7c9eab135965380152f94fa1a6e92625e634d93252895bb2623fb74677c7b5d67801ba4d9a940dcc07c5c90bd11737bdd455b98b6de977ae063801c564fc

  • SSDEEP

    393216:uoVR42a3GdQ2lN/m3pS+9J8etH4Fw4Jt8hXeSP:uoH42a2dQGKB9J8etYUP

Malware Config

Targets

    • Target

      generator.exe

    • Size

      18.1MB

    • MD5

      50326eb5494a005b977a52e841c92a96

    • SHA1

      caddbc1617aca27b26566864ad08aab63ee7b4a8

    • SHA256

      e55090bd04f0dc4545b9ff2557d0e10e131d0fafb9e7f76ca939837a246af302

    • SHA512

      cc3d7c9eab135965380152f94fa1a6e92625e634d93252895bb2623fb74677c7b5d67801ba4d9a940dcc07c5c90bd11737bdd455b98b6de977ae063801c564fc

    • SSDEEP

      393216:uoVR42a3GdQ2lN/m3pS+9J8etH4Fw4Jt8hXeSP:uoH42a2dQGKB9J8etYUP

    Score
    7/10
    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Tasks