c8b514c3f087a82fe2d755bc65404e59e14a45fb9c737e08eeccb8f89cf74a62

Sharing

Copy URL Twitter E-mail

General

Target
Steam_6n0hahx7.exe
Size 66.0MB
Sample240407-yft4mscf4x
SHA256 c8b514c3f087a82fe2d755bc65404e59e14a45fb9c737e08eeccb8f89cf74a62
MD5 0fdcca7656426e2f1ecbec3f17b767b9
SHA1 06f2f8abd81e54ca566b2c1a6568df792e6e8afa
SHA512 5e98a2dbaf843865b013c62ba44f8338722282fc2c9494acfdd5e7f5ceb4c224b96a69444a168fbfe548ae7639645122251785bce81bfa10e2dfb64632a1a289
SSDEEP 1572864:hrziNx5qAk4h8+SATr6YFE5FpGyHrW58l3ccY0JA2Gbm+8CeIw7:Mx5qA4YIGyrFl3LueIw7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  Steam_6n0hahx7.exe
- Size 66.0MB
- SHA256 c8b514c3f087a82fe2d755bc65404e59e14a45fb9c737e08eeccb8f89cf74a62
- MD5 0fdcca7656426e2f1ecbec3f17b767b9
- SHA1 06f2f8abd81e54ca566b2c1a6568df792e6e8afa
- SHA512 5e98a2dbaf843865b013c62ba44f8338722282fc2c9494acfdd5e7f5ceb4c224b96a69444a168fbfe548ae7639645122251785bce81bfa10e2dfb64632a1a289
- SSDEEP 1572864:hrziNx5qAk4h8+SATr6YFE5FpGyHrW58l3ccY0JA2Gbm+8CeIw7:Mx5qA4YIGyrFl3LueIw7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  LICENSES.chromium.html
- Size 6.5MB
- SHA256 0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
- MD5 180f8acc70405077badc751453d13625
- SHA1 35dc54acad60a98aeec47c7ade3e6a8c81f06883
- SHA512 40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec
- SSDEEP 24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  Steam.exe
- Size 154.5MB
- SHA256 0177dec5005ce11309a54c49bc6a36c97008751db890b7bdf6c9eba48815acef
- MD5 8a3861c725d108eb0c1a17fa43f0487a
- SHA1 e4b713028e43e0f99e4568aa3902384b52951ed2
- SHA512 db3765823fd8bea6e6b1c17b8144038586e5089b20c6ee70e517cb5c864ec874f82cf08696cebb48b148683de3f6bea93b65d26c58f166a7bb3defd49e5dd3ad
- SSDEEP 1572864:UCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:eDAgZi
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral5
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
- MD5 d49e7a8f096ad4722bd0f6963e0efc08
- SHA1 6835f12391023c0c7e3c8cc37b0496e3a93a5985
- SHA512 ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575
- SSDEEP 49152:XMoI7Qj3trgDtcfkW76fSL5Yqq6uthy4Y6NO8PyJegPTagrcjdiCOi2iNN3lzl3U:H3Kk76fUq/4TagreBOirnW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  libEGL.dll
- Size 468KB
- SHA256 d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
- MD5 09134e6b407083baaedf9a8c0bce68f2
- SHA1 8847344cceeab35c1cdf8637af9bd59671b4e97d
- SHA512 6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba
- SSDEEP 12288:su0LAjbIkyVVR8O9v/6TiT5eU3axzvYwo:sub49/6TiQzvYX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  libGLESv2.dll
- Size 7.2MB
- SHA256 50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
- MD5 a5f1921e6dcde9eaf42e2ccc82b3d353
- SHA1 1f6f4df99ae475acec4a7d3910badb26c15919d1
- SHA512 0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702
- SSDEEP 98304:BuT3g23jeZ/02YPuLaw5RoD1rfEQ3CPdOEabcgsOMdi:BuDPTwLap14QzEijsvi
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  vk_swiftshader.dll
- Size 5.0MB
- SHA256 6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
- MD5 a0845e0774702da9550222ab1b4fded7
- SHA1 65d5bd6c64090f0774fd0a4c9b215a868b48e19b
- SHA512 4be0cb1e3c942a1695bae7b45d21c5f70e407132ecc65efb5b085a50cdab3c33c26e90bd7c86198ec40fb2b18d026474b6c649776a3ca2ca5bff6f922de2319b
- SSDEEP 49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  vulkan-1.dll
- Size 899KB
- SHA256 f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
- MD5 0e4e0f481b261ea59f196e5076025f77
- SHA1 c73c1f33b5b42e9d67d819226db69e60d2262d7b
- SHA512 e6127d778ec73acbeb182d42e5cf36c8da76448fbdab49971de88ec4eb13ce63140a2a83fc3a1b116e41f87508ff546c0d7c042b8f4cdd9e07963801f3156ba2
- SSDEEP 24576:PR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:PR1l1culw6Z5WUDYsH56g3P0zAk7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13