General

  • Target

    WaveSplotBeta.exe

  • Size

    30.5MB

  • Sample

    240425-2hheeaga59

  • MD5

    fa7ff55a94d629ca1af12bba73582635

  • SHA1

    ff0dc0e3b466a06472387387163517839f30a9c6

  • SHA256

    7ae0e1f67e9b3874583a53d7399d4a75ab794561b0d62423542c6e4558e3bc35

  • SHA512

    aa80f829f6a8620276174bec73a8139d8b19f2c893316f142cda922e4d31236dacb86fba3f4586203ba092f5875205f1d3f5d339fa432be9a9db2aba6b8e77db

  • SSDEEP

    786432:naAWibibX71QtIJ2j6+s7LWB75zuPNdS3ILn6eByJKm+da:naHbXJiIJ2qHWB75iVdSG1BzA

Malware Config

Targets

    • Target

      WaveSplotBeta.exe

    • Size

      30.5MB

    • MD5

      fa7ff55a94d629ca1af12bba73582635

    • SHA1

      ff0dc0e3b466a06472387387163517839f30a9c6

    • SHA256

      7ae0e1f67e9b3874583a53d7399d4a75ab794561b0d62423542c6e4558e3bc35

    • SHA512

      aa80f829f6a8620276174bec73a8139d8b19f2c893316f142cda922e4d31236dacb86fba3f4586203ba092f5875205f1d3f5d339fa432be9a9db2aba6b8e77db

    • SSDEEP

      786432:naAWibibX71QtIJ2j6+s7LWB75zuPNdS3ILn6eByJKm+da:naHbXJiIJ2qHWB75iVdSG1BzA

    Score
    7/10
    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      ZAZAZAZAZAZAZAZA.pyc

    • Size

      69KB

    • MD5

      aca511612d6cf997abbd563f47c62bce

    • SHA1

      86d94f655e05ed27d9f218aede47d7098636d074

    • SHA256

      d6ec730a7fa4367cbac3ed1050340b0feef787ccae5a5f99d2bd9a6cbe573752

    • SHA512

      9cd6401d08d7da608ce562adff0fe601441d7cf9afe0ff9f2948a6935e001d46c70c99b513006ae88354621273c0ffe92b9b9456accc43c0dc84c0fe7c7bc82e

    • SSDEEP

      768:P+kW3pBwVCnMxvYTLg5xvbiueCKC3rWnXTxHrdFd7nt4fTe1AnjXPnrUPJy:PupBCCofCx4fSKrPrf

    Score
    4/10

MITRE ATT&CK Enterprise v15

Tasks