60119b9585f651bf504c1c0215ee1067c6247f20fabf590aedce27138d4627fe | Triage

Sharing

General

Target

8c3d24444b55e491253d0c584acf1cf0
Size

7.6MB
Sample

231222-pym9dacdf3
MD5

8c3d24444b55e491253d0c584acf1cf0
SHA1

0c274f62618a9157f32156bf35f736a1e9767c46
SHA256

60119b9585f651bf504c1c0215ee1067c6247f20fabf590aedce27138d4627fe
SHA512

aa249c156775edcdc672dd79a9c0200c1c3006accb0d745291af3029e7a4988409a2c1ebe8b6d11ea05bb742e53cb790474ae128ac701d48efb100c68dc8e47d
SSDEEP

196608:/hzkpaoCsXDjDyf0wKP5W3I6sKpDfyOA6yHjmYL+H9uCxic:hiDCEDWKRW3I1KpD8n/iICx

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  8c3d24444b55e491253d0c584acf1cf0
- Size
  
  7.6MB
- MD5
  
  8c3d24444b55e491253d0c584acf1cf0
- SHA1
  
  0c274f62618a9157f32156bf35f736a1e9767c46
- SHA256
  
  60119b9585f651bf504c1c0215ee1067c6247f20fabf590aedce27138d4627fe
- SHA512
  
  aa249c156775edcdc672dd79a9c0200c1c3006accb0d745291af3029e7a4988409a2c1ebe8b6d11ea05bb742e53cb790474ae128ac701d48efb100c68dc8e47d
- SSDEEP
  
  196608:/hzkpaoCsXDjDyf0wKP5W3I6sKpDfyOA6yHjmYL+H9uCxic:hiDCEDWKRW3I1KpD8n/iICx
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2