Overview

overview

10

Static

static

10

ebba7cb9c5...1e.exe

windows7-x64

7

ebba7cb9c5...1e.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebba7cb9c57d1437297a8216b8d83b7b68a143c8c3768d3570ed3f0d95c30c1e

  • Size

    15.7MB

  • Sample

    231028-ylq9yagg55

  • MD5

    23a7f25e8740f46a9570fe3a516bd264

  • SHA1

    5668834dc5d7be5e31c19e2d545f43ed361faa5f

  • SHA256

    ebba7cb9c57d1437297a8216b8d83b7b68a143c8c3768d3570ed3f0d95c30c1e

  • SHA512

    0902816da5bb34c8e63119801e54c98532333d95722e777e4eae0ce2fff2576b0a0850265e69ba27a512b608b86e92200a314a102f9d604a84db1881834eae09

  • SSDEEP

    393216:jiIE7Yo9+4uOwrHi+2ohcyLkW+eGQRe9jo7BGcGYaJKt/WorLP:Q7r9+ROEHiRyc0kW+e5Re9MZprLP

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      ebba7cb9c57d1437297a8216b8d83b7b68a143c8c3768d3570ed3f0d95c30c1e

    • Size

      15.7MB

    • MD5

      23a7f25e8740f46a9570fe3a516bd264

    • SHA1

      5668834dc5d7be5e31c19e2d545f43ed361faa5f

    • SHA256

      ebba7cb9c57d1437297a8216b8d83b7b68a143c8c3768d3570ed3f0d95c30c1e

    • SHA512

      0902816da5bb34c8e63119801e54c98532333d95722e777e4eae0ce2fff2576b0a0850265e69ba27a512b608b86e92200a314a102f9d604a84db1881834eae09

    • SSDEEP

      393216:jiIE7Yo9+4uOwrHi+2ohcyLkW+eGQRe9jo7BGcGYaJKt/WorLP:Q7r9+ROEHiRyc0kW+e5Re9MZprLP

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks