crealstealer | c94ecb268a02274d58417706b8ff0deddf21036a68c4ad692cdf43127905e541

Resubmissions

28-02-2024 03:00

240228-dhl6lahh24 10

28-02-2024 02:56

240228-dfe99shg73 10

28-02-2024 02:49

240228-dbbraahf62 10

28-02-2024 02:45

240228-c81k8shd8s 10

Sharing

Copy URL

Twitter E-mail

General

Target

Daily Claim.exe
Size

13.2MB
Sample

240228-dhl6lahh24
MD5

409e87f8771c8608e3ab31ecc1eb58a5
SHA1

987d8150b5b7cd0cbdf0ab20e3633666082dfd0f
SHA256

c94ecb268a02274d58417706b8ff0deddf21036a68c4ad692cdf43127905e541
SHA512

bfa93a5d04a1ecdac4d132e27b0885d062737804a5db717e648d81b2a22bfbf7102f0b44de8dc4f425c109196b32bf1a3151af69b71e7a3d63f5c11354e48ab3
SSDEEP

393216:TsiIE7Yop9dM/IS+DfDgrc6lAfVe5ef+G:Tl7rpT6IS+b0I9fI5ef

Score

10^/10

Malware Config

Targets

- Target
  
  Daily Claim.exe
- Size
  
  13.2MB
- MD5
  
  409e87f8771c8608e3ab31ecc1eb58a5
- SHA1
  
  987d8150b5b7cd0cbdf0ab20e3633666082dfd0f
- SHA256
  
  c94ecb268a02274d58417706b8ff0deddf21036a68c4ad692cdf43127905e541
- SHA512
  
  bfa93a5d04a1ecdac4d132e27b0885d062737804a5db717e648d81b2a22bfbf7102f0b44de8dc4f425c109196b32bf1a3151af69b71e7a3d63f5c11354e48ab3
- SSDEEP
  
  393216:TsiIE7Yop9dM/IS+DfDgrc6lAfVe5ef+G:Tl7rpT6IS+b0I9fI5ef
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  Boobies.pyc
- Size
  
  29KB
- MD5
  
  e6b6c704fe4a55e2bd73ee2888e2bfb2
- SHA1
  
  77e532787b7b56321e405a710e9f63895020298f
- SHA256
  
  d1f80380fe99d7d9a052f145c6abc1b7ce844ec040f967bc4d120aa6ea4b1a1a
- SHA512
  
  91582b076bdd4976de8bd51b7c54397f25025f4b6668c33c58936a9c8d269afffb124fa74f6ef4f7354ef994b2f0f20fb27b0cc779d0b744fd77e56dc2034156
- SSDEEP
  
  768:3+lVSpnrWWk/4VDiiyAuoGyXzPBfIfTVRWSrdbHsJ1Kh7C5r:30StrWqG3KDBfI5RgKh7Qr
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4