218fcdeec746d6447b741840c9db9663e721273c8f36a724f5f8e0ba48121cd1 | Triage

Sharing

General

Target

paid_spoofer.exe
Size

17.7MB
Sample

240408-pba1jaca8x
MD5

e254e0c0b7ef2e8a8cf7e89525bf4699
SHA1

46dc41f0ae6be1cb83cccd3d3d2de2ed80a09bea
SHA256

218fcdeec746d6447b741840c9db9663e721273c8f36a724f5f8e0ba48121cd1
SHA512

d055f83d55b0f88444575d63bfe05530f0014310294d52718909db387c0e1f6582d61618a28b74597c1ee67660e2bb499f6a1eca91427b25ca98e1e976658048
SSDEEP

393216:BEkQRN6xrvaUX47d45brpJxpu1FjLEO/+sx:B6N6laUI7d45b9gQOW

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  paid_spoofer.exe
- Size
  
  17.7MB
- MD5
  
  e254e0c0b7ef2e8a8cf7e89525bf4699
- SHA1
  
  46dc41f0ae6be1cb83cccd3d3d2de2ed80a09bea
- SHA256
  
  218fcdeec746d6447b741840c9db9663e721273c8f36a724f5f8e0ba48121cd1
- SHA512
  
  d055f83d55b0f88444575d63bfe05530f0014310294d52718909db387c0e1f6582d61618a28b74597c1ee67660e2bb499f6a1eca91427b25ca98e1e976658048
- SSDEEP
  
  393216:BEkQRN6xrvaUX47d45brpJxpu1FjLEO/+sx:B6N6laUI7d45b9gQOW
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2