General

  • Target

    hitomi_downloader_GUI.exe

  • Size

    111.6MB

  • Sample

    240424-fdp3ssfa9v

  • MD5

    cf1e1a347538a17d3f413218e287b499

  • SHA1

    aa3beadd83967d88ac690f81925165e0c42b6d49

  • SHA256

    75f191b3cc511ec05809584488df9f054c94f53afd4de0140f165c7fe88148ec

  • SHA512

    be931df605edbb3e9a9cfa180dc19fdcafbce5487c21a0046042858ff421bf1846b9015998186d41994615d2a5364697014ec160bd5fc9a0b9bf3a9226c16dc7

  • SSDEEP

    3145728:fXwQlVCM9dtGxzClvbvOT+gVxZ+tK++gwtYRps6gB:PJcClvDW5+17R

Malware Config

Targets

    • Target

      hitomi_downloader_GUI.exe

    • Size

      111.6MB

    • MD5

      cf1e1a347538a17d3f413218e287b499

    • SHA1

      aa3beadd83967d88ac690f81925165e0c42b6d49

    • SHA256

      75f191b3cc511ec05809584488df9f054c94f53afd4de0140f165c7fe88148ec

    • SHA512

      be931df605edbb3e9a9cfa180dc19fdcafbce5487c21a0046042858ff421bf1846b9015998186d41994615d2a5364697014ec160bd5fc9a0b9bf3a9226c16dc7

    • SSDEEP

      3145728:fXwQlVCM9dtGxzClvbvOT+gVxZ+tK++gwtYRps6gB:PJcClvDW5+17R

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks