Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-02-2024 10:08
Behavioral task
behavioral1
Sample
PASS 123/Cheat.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PASS 123/Cheat.exe
Resource
win10v2004-20240221-en
General
-
Target
PASS 123/Cheat.exe
-
Size
632KB
-
MD5
5e5b920da0202fcaea9b4ca3343e905a
-
SHA1
f22b1b8cdf7ab8622b8b73436ecf79a05af60b13
-
SHA256
36fb80d3f7ee60a1d1d1e9975177dab0885e792fe09b443d0a38f72f0f36aad3
-
SHA512
dce1f9b57bf9f6aacc5d97e6ecc1f69e64be2a0b39f4d62982f2de9662186a0d9f8c9f679a2f57267dda2b2a0cf8bd75e60c6e371638c7cfa30f48d50df45940
-
SSDEEP
12288:qu02MXY5M92Sc9Cf7g9CXC2dDUpqDJlrjKLUozRS8pnk5:quj4qM9299CTg9CXCqD/rjKQAnk5
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Cheat.exepid process 2300 Cheat.exe