Overview

overview

7

Static

static

1

NobodysLefts.exe

windows7-x64

7

NobodysLefts.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    NobodysLefts.rar

  • Size

    61.4MB

  • Sample

    231107-xzs51seb5y

  • MD5

    6efa9953fc5fd5f1e4edbe232cd613f3

  • SHA1

    c08f646ea541c314153df19e97b6d71700f6d48c

  • SHA256

    299ba16450d7dfba75d3f2342eb8f4b138b65c434654a758bc2108fd61dfddbe

  • SHA512

    317c46cfaae17407c4f57aca674b795635756699107d62e8be8a065f720f486c9c4014d6ba5ee24691b7613ab691d078c8251b87519e1f0e9ec9bb2159e51907

  • SSDEEP

    1572864:+gWHMQxHmi166AMp8d6gDa6iLuqiNuo7TmIaOpZpFusADUO0kTp6:+HHRxHb1MMSd6gWR+NuETmIa+Z2BDin

Score
7/10
spywarestealer

Malware Config

Targets

    • Target

      NobodysLefts.exe

    • Size

      61.5MB

    • MD5

      65936fadb8c43a12b74d2189b0fcfe4b

    • SHA1

      6836ad0b230827b3d8d9ec068c6396179d6389cf

    • SHA256

      acef46c9bb65ec0bc83502ebfae1a77baecdbcf8ce903c3128651c57ea824d06

    • SHA512

      3f6d261142f753d74c7788e93c2940dc40a2885d1c99214ddf268e3eb8969d6b4f726a3ad0e1d10045d3fd161552e98fb2e26494f1896a83ed6bb9cd244822cf

    • SSDEEP

      1572864:Om6EIYML2wwUHrqcKw+V9kulozpfHatc6FHQQW3svJ:l6EIYVwwUHtKw+UuOVStc4QQW3svJ

    Score
    7/10
    spywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks