Overview

overview

7

Static

static

1

valo_free.exe

windows7-x64

7

valo_free.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    valo_free.exe

  • Size

    68.8MB

  • Sample

    230828-bywzmaee49

  • MD5

    5b471b13a93b597ebe0dbe0c953168c5

  • SHA1

    21cb74afd31e033a6fc02943051ba428983bcba3

  • SHA256

    e9e64ec7cd3f59aaf62e78aa025aa15f41ebcfc9a3036abcee90cc4063d2aa60

  • SHA512

    4b95791a514d1ca89be6260da79ec2340ca209144f1153a73e81e97ac5c64648d56abbe9d63ce6e8cda82773bd7e361cdf6f271202426708a9285c68b7b78254

  • SSDEEP

    1572864:3jddGviCiYAFd+Jh67EdAd2DREzzJ6/xqhMZ9sJRHT:zGvlisP6Ydb0J6/khA9uT

Score
7/10
spywarestealer

Malware Config

Targets

    • Target

      valo_free.exe

    • Size

      68.8MB

    • MD5

      5b471b13a93b597ebe0dbe0c953168c5

    • SHA1

      21cb74afd31e033a6fc02943051ba428983bcba3

    • SHA256

      e9e64ec7cd3f59aaf62e78aa025aa15f41ebcfc9a3036abcee90cc4063d2aa60

    • SHA512

      4b95791a514d1ca89be6260da79ec2340ca209144f1153a73e81e97ac5c64648d56abbe9d63ce6e8cda82773bd7e361cdf6f271202426708a9285c68b7b78254

    • SSDEEP

      1572864:3jddGviCiYAFd+Jh67EdAd2DREzzJ6/xqhMZ9sJRHT:zGvlisP6Ydb0J6/khA9uT

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks