Overview

overview

10

Static

static

10

3.exe

windows7-x64

7

3.exe

windows10-1703-x64

7

3.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3.exe

  • Size

    16.4MB

  • Sample

    231119-qj37qaac23

  • MD5

    5bac8d676a3508917ddd8870c934a318

  • SHA1

    4c3457b238f92a97485d4ece550a97fdba11389c

  • SHA256

    6b6e93484007f763fb3371b8b097ef1a87ed0e601a141f1449a8aebce685b37c

  • SHA512

    5bd0ba3b5574b46fb1527cd0da6ed9a6b2522d1c38ac3ec12fcf3589de162688040cd60b72f6498729354d0f1de0b78ee226f63af9f3e6c7872a81f133082942

  • SSDEEP

    393216:/u7L/zHi+2ohcyLbdQusl7Q+l9RoWOv+9faTkTJtB0X:/CLbHiRyc0bdQu2QGborvSis

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      3.exe

    • Size

      16.4MB

    • MD5

      5bac8d676a3508917ddd8870c934a318

    • SHA1

      4c3457b238f92a97485d4ece550a97fdba11389c

    • SHA256

      6b6e93484007f763fb3371b8b097ef1a87ed0e601a141f1449a8aebce685b37c

    • SHA512

      5bd0ba3b5574b46fb1527cd0da6ed9a6b2522d1c38ac3ec12fcf3589de162688040cd60b72f6498729354d0f1de0b78ee226f63af9f3e6c7872a81f133082942

    • SSDEEP

      393216:/u7L/zHi+2ohcyLbdQusl7Q+l9RoWOv+9faTkTJtB0X:/CLbHiRyc0bdQu2QGborvSis

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks