General
-
Target
Beer.exe
-
Size
23.2MB
-
Sample
240203-qvtgnaaeg5
-
MD5
fdebe894eda4d5aad16943b0c79299ad
-
SHA1
b75eda0457f2dc943f06f0409e82b6d999751fb7
-
SHA256
abf3e1ee8c99bef5a705e8511fbbd28439491b09bf015ebe0d4e326c91fd822e
-
SHA512
dda8ad699d3fd7e4dbdf35491b92e3170aadb20ebd0ccfa17603cb8e68512ba9a2d23e26db17910e05209c72ea7cd588d35d2959fce5bd721d1a04dcf8e6593b
-
SSDEEP
393216:+iIE7YoPQtss27JwRW+eGQRj93iObIWRS/KYc2Pz21t/XYNk/yK3oLqIkPtFrCvE:/7rPQtsbwRW+e5RB9MWRljE+/YLKY1ns
Behavioral task
behavioral1
Sample
Beer.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Beer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
Beer.exe
-
Size
23.2MB
-
MD5
fdebe894eda4d5aad16943b0c79299ad
-
SHA1
b75eda0457f2dc943f06f0409e82b6d999751fb7
-
SHA256
abf3e1ee8c99bef5a705e8511fbbd28439491b09bf015ebe0d4e326c91fd822e
-
SHA512
dda8ad699d3fd7e4dbdf35491b92e3170aadb20ebd0ccfa17603cb8e68512ba9a2d23e26db17910e05209c72ea7cd588d35d2959fce5bd721d1a04dcf8e6593b
-
SSDEEP
393216:+iIE7YoPQtss27JwRW+eGQRj93iObIWRS/KYc2Pz21t/XYNk/yK3oLqIkPtFrCvE:/7rPQtsbwRW+e5RB9MWRljE+/YLKY1ns
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
main.pyc
-
Size
129KB
-
MD5
105d0a6d2ae37610e0880619a1ea0bf4
-
SHA1
fc9ef490866cda64b722296c604e21167618d6d7
-
SHA256
7b5ead783a681321ff62b1b5876a351353c566acbb871376bdb0484390cdeb22
-
SHA512
1ac63a238e3369bade1e5d346e9c8200d2770775d527b11a715da2f6a83eed3461972d3810d3f7797b4c5cad133841f3c68f0cde7839e10ef4ac936218515a79
-
SSDEEP
3072:Jf+7o/IsJ9VgavY3A5Fvz7hjYsaaXavtPV8TjsYy:ao/IsjaC0A5Fvz7hjYsaaqtPGTj4
Score3/10 -