General
-
Target
launcher.bat
-
Size
17.3MB
-
Sample
240217-axkdrshg37
-
MD5
7430c55a5b4e2fc81a818f97a1df2208
-
SHA1
d0c70e8886d4ced9f243771b860ce3f7deafaa54
-
SHA256
ebced7a54adf26c1fe02cce2a9c3135b7331f479350b1636f2b9231ed1cc75bb
-
SHA512
59d91b7bbbd07ee05a5370a5eaf1c19d881da813d6c251df30a90c65ad1747e624454c1dc5a823d7e247421a4bbcbcb7d4926d3c74b6c6bfb991d472e18b456d
-
SSDEEP
393216:Vu7L/sQToDpUTLfhJjdQuslSl99oWOv+9fgd7LwfmR9:VCL0QTAUTLJRdQu9DorvSYdfwe
Malware Config
Targets
-
-
Target
launcher.bat
-
Size
17.3MB
-
MD5
7430c55a5b4e2fc81a818f97a1df2208
-
SHA1
d0c70e8886d4ced9f243771b860ce3f7deafaa54
-
SHA256
ebced7a54adf26c1fe02cce2a9c3135b7331f479350b1636f2b9231ed1cc75bb
-
SHA512
59d91b7bbbd07ee05a5370a5eaf1c19d881da813d6c251df30a90c65ad1747e624454c1dc5a823d7e247421a4bbcbcb7d4926d3c74b6c6bfb991d472e18b456d
-
SSDEEP
393216:Vu7L/sQToDpUTLfhJjdQuslSl99oWOv+9fgd7LwfmR9:VCL0QTAUTLJRdQu9DorvSYdfwe
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-