General

  • Target

    5ad5fcac5705acde3ed51ae6b3c2c0b1.bin

  • Size

    288KB

  • Sample

    240124-cknxjafgbq

  • MD5

    fe839e23b0417e7a6e3e9cecbb472882

  • SHA1

    47696e55fd29df69b0977de2d408995f182c092c

  • SHA256

    8aa7d04339f3e0474f70ca4f790be5f6273e8ef66e0ff3620b21a48c0201f87f

  • SHA512

    6c44ba9e5eb41a3dc0a5da9dde4d3840e289d05bf1c6d327d5f06c0daad0ccbe00ff2499fc20085a7c79c097af18516d6fb995767b45a7c67988b073a6f2a928

  • SSDEEP

    6144:VGbqFCXlC7ymG2y8KBVDvl1jRAbpYUcy63Jz1cIyQBySGR4P:VGACXKyT2MBVDLlOpM5oSQ4P

Malware Config

Targets

    • Target

      52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63.exe

    • Size

      401KB

    • MD5

      5ad5fcac5705acde3ed51ae6b3c2c0b1

    • SHA1

      77a26b80323ac8e1f172d8ce980120454ed53939

    • SHA256

      52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63

    • SHA512

      1b472fc9a53b6a8864176dbd7e1ce91dccdae9c6dcf9716274c80011368275dc1f3c2098287bd32d708ce18214b048113fdc59cefd3a106a1d2b6ddaee304a27

    • SSDEEP

      12288:3kvqcSBHwEbBn+mDZVKxRu2GfWLpcCoJt:9wOTZVKbgWLCCat

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      17ed1c86bd67e78ade4712be48a7d2bd

    • SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    • SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    • SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

    • SSDEEP

      192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      42b064366f780c1f298fa3cb3aeae260

    • SHA1

      5b0349db73c43f35227b252b9aa6555f5ede9015

    • SHA256

      c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab

    • SHA512

      50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7

    • SSDEEP

      192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      b55f7f1b17c39018910c23108f929082

    • SHA1

      1601f1cc0d0d6bcf35799b7cd15550cd01556172

    • SHA256

      c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7

    • SHA512

      d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa

    • SSDEEP

      96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN

    Score
    3/10
    • Target

      Proctodynia/megapode.app

    • Size

      15KB

    • MD5

      6e941ea97a92ac8ee4ac713c354c58f6

    • SHA1

      3f23f03bf6547b2bf4b8a6eb00777a55aaf999ce

    • SHA256

      a3a45b243179f04a923e01a8f360aafa9d628b32354453f08c0b1c31797a534b

    • SHA512

      d2b43f6cf6d7e74c1053416213fcc35c30ca029c0c2f34de9553ad2adb92b923daf83611ba9b7b9d905ad1e60c53434dcd7ea58d3c0bf47ffa8b0e59b6cea489

    • SSDEEP

      384:U5FKcGSrXmxrPAn8EFGftXcMOxFILjA1BoLSw9QVN/Nr:IFUAYDEwftXcMkujKo6/Nr

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks