Overview

overview

10

Static

static

10

PpQMwNh.exe

windows7-x64

7

PpQMwNh.exe

windows10-1703-x64

10

PpQMwNh.exe

windows10-2004-x64

7

PpQMwNh.exe

windows11-21h2-x64

7

�����.pyc

windows7-x64

�����.pyc

windows10-1703-x64

�����.pyc

windows10-2004-x64

�����.pyc

windows11-21h2-x64

Resubmissions

25/01/2024, 20:18

240125-y3ebpsfdfm 10

25/01/2024, 20:18

240125-y3d1yafdfk 10

25/01/2024, 20:18

240125-y3dp6seed4 10

25/01/2024, 20:18

240125-y3deeafdfj 10

25/01/2024, 19:59

240125-yqfc8seca6 10

25/01/2024, 19:39

240125-ycx15adhe3 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    PpQMwNh.exe

  • Size

    5.8MB

  • Sample

    240125-y3d1yafdfk

  • MD5

    6aa3d7034efb39e1f3ab6b23f8fd19cc

  • SHA1

    7c2db3e3a5e3a6b435de2df7a51451afa22d438c

  • SHA256

    99db6d7cf246d15e9a07808daa18285e39125169e20aa4353be054528c60c7ba

  • SHA512

    be5bcdca1abb9f6160f0008d3e958f2c59214e6177103e270c2578999a06f7144c376aa6b2df305f596cb99e85b613ad036796ccd1d8c8b1fb3dbeab518ca542

  • SSDEEP

    98304:HRW+WCHTpi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFj9hhkAilAx:HzrfDOYjJlpZstQoS9Hf12VKX0bhhN

Score
10/10
blankgrabberevasionspywarestealerupx

Malware Config

Targets

    • Target

      PpQMwNh.exe

    • Size

      5.8MB

    • MD5

      6aa3d7034efb39e1f3ab6b23f8fd19cc

    • SHA1

      7c2db3e3a5e3a6b435de2df7a51451afa22d438c

    • SHA256

      99db6d7cf246d15e9a07808daa18285e39125169e20aa4353be054528c60c7ba

    • SHA512

      be5bcdca1abb9f6160f0008d3e958f2c59214e6177103e270c2578999a06f7144c376aa6b2df305f596cb99e85b613ad036796ccd1d8c8b1fb3dbeab518ca542

    • SSDEEP

      98304:HRW+WCHTpi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFj9hhkAilAx:HzrfDOYjJlpZstQoS9Hf12VKX0bhhN

    Score
    10/10
    upxevasionspywarestealer

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4

    • Target

      �����.pyc

    • Size

      857B

    • MD5

      20b3eae88bd2ed8fe10544eda78703be

    • SHA1

      b90db92155a17c0044c6034d4cb8d2138bb04e7a

    • SHA256

      adee989233cbb96b6b236c4bc505d034574ee2e8fe699763c7ec91e35a102791

    • SHA512

      24bee75c22c26952f890c624fb05917881978a4da44fa8f239b161163909f6a012bac7ae0d901db8970a7919615866678a4ef84eed6fb1e727029a3479724c0f

    Score
    1/10
    behavioral5behavioral6behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks