hxxps://winebottler[.]kronenberg[.]org/download[.]php?f=WineBottlerCombo_1[.]8[.]6[.]dmg&m=d2luZWJvdHRsZXIua3JvbmVuYmVyZy5vcmcvY29tYm8vYnVpbGRzhxxps://s28667145[.]weebly[.]com/memz-download[.]html

Sharing

Copy URL

Twitter E-mail

General

Target

https://winebottler.kronenberg.org/download.php?f=WineBottlerCombo_1.8.6.dmg&m=d2luZWJvdHRsZXIua3JvbmVuYmVyZy5vcmcvY29tYm8vYnVpbGRzhttps://s28667145.weebly.com/memz-download.html
Sample

240326-e4v63ada28

Score

10^/10

Malware Config

Targets

- Target
  
  https://winebottler.kronenberg.org/download.php?f=WineBottlerCombo_1.8.6.dmg&m=d2luZWJvdHRsZXIua3JvbmVuYmVyZy5vcmcvY29tYm8vYnVpbGRzhttps://s28667145.weebly.com/memz-download.html
Score

10^/10

phishing antivm spyware stealer collection discovery evasion
- Detected phishing page
  phishing
- Path Permission
  Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
  evasion
- Changes its process name
- Reads the content of photos stored on the user's device.
  collection
- Reads user data of web browsers
  Reads stored browser data which can include saved credentials.
  spyware stealer
- Checks CPU configuration
  Checks CPU information which indicate if the system is a virtual machine.
  antivm
- Gatekeeper Bypass
  Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
  evasion
- Reads CPU attributes
- File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
  evasion
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Detected phishing page

Path Permission

Changes its process name

Reads the content of photos stored on the user's device.

Reads user data of web browsers

Checks CPU configuration

Gatekeeper Bypass

Reads CPU attributes

File Deletion

MITRE ATT&CK Matrix

Tasks

static1

urlscan1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16