9832647d56bce277c025944ca38095da9942add7aa235893785a3d8e86eaa4ed | Triage

Resubmissions

13-07-2023 13:45

230713-q2d1jsgh87 7

11-07-2023 19:06

230711-xr6fdabf3v 7

11-07-2023 19:04

230711-xq3cbsae78 3

11-07-2023 18:41

230711-xb55nsae49 7

11-07-2023 18:30

230711-w5nbaaae42 7

Sharing

General

Target

CapCut_2_2_0_491_capcutpc_0.gz
Size

21.0MB
Sample

230711-xr6fdabf3v
MD5

1148ec3fbaf703ff99d63e4be173db46
SHA1

88a37a64365ef6b6c2cd113313faed825bd74022
SHA256

9832647d56bce277c025944ca38095da9942add7aa235893785a3d8e86eaa4ed
SHA512

b08bcf60f7641c91a7fae604387ab5a7cffcced7c72108e168225cbc17fd037542f2f70691b663a935598a2f91648ee4a3b6caa47f72b906d206bf669ca6bc37
SSDEEP

393216:eDOT+7oif4tug1xIgD87Sui8hgUZ8X5+qhBcczwSjm6tqI/XfSmImmn9h120NxeB:eDl7jwuAxl87SN8hgi8v/ccDm+/XamIO

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  CapCut_2_2_0_491_capcutpc_0/CapCut_2_2_0_491_capcutpc_0.exe
- Size
  
  58.6MB
- MD5
  
  bbe506388a97274805cc8d3c91cf67ac
- SHA1
  
  b2896db7d28fe66c612d900971ca05a9f7c37429
- SHA256
  
  d6aee63ffe429ddb9340090bff2127efad340240954364f1c996a8da6b711374
- SHA512
  
  4d27b1de445be7440b3c80e4070b60aefabf2cad45e2f73acfed79675ef8af2dd12c696e3f6adebbe9a7a809160ecbd672260ffa8e8e0b7b75462b9d89adfa95
- SSDEEP
  
  393216:SQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgd96l+ZArYsFRlLNK:S3on1HvSzxAMNdFZArYsTNSgIm1G
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2