543716cf3dfbf699bdc25710643bb151cae95e3e12f0006b4adf279665469c27 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aimbotmta.exe
Size

17.3MB
Sample

240426-fkyzaaab63
MD5

044e0fdf6ea30aaf33d8f531ddc8de3d
SHA1

a53d7d12ea1c94973760b603877d754871eaec0b
SHA256

543716cf3dfbf699bdc25710643bb151cae95e3e12f0006b4adf279665469c27
SHA512

0bd9b03ab4973df45c9fd6ce06b0cb3252fbb0c795ba5800b6e56dd71412ac52d5b5fe4db807c13b22531a399f6af802c4e7081a4376d533fd54b54f95a06177
SSDEEP

393216:fEkFq5ZgP8AxYDX1+TtIiFvY9Z8D8Ccl6lq2tGtomGMtQS7LnwxgK:fNcZbX71QtI6a8DZcIlqFtdyEK

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  aimbotmta.exe
- Size
  
  17.3MB
- MD5
  
  044e0fdf6ea30aaf33d8f531ddc8de3d
- SHA1
  
  a53d7d12ea1c94973760b603877d754871eaec0b
- SHA256
  
  543716cf3dfbf699bdc25710643bb151cae95e3e12f0006b4adf279665469c27
- SHA512
  
  0bd9b03ab4973df45c9fd6ce06b0cb3252fbb0c795ba5800b6e56dd71412ac52d5b5fe4db807c13b22531a399f6af802c4e7081a4376d533fd54b54f95a06177
- SSDEEP
  
  393216:fEkFq5ZgP8AxYDX1+TtIiFvY9Z8D8Ccl6lq2tGtomGMtQS7LnwxgK:fNcZbX71QtI6a8DZcIlqFtdyEK
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  creal.pyc
- Size
  
  64KB
- MD5
  
  aa0a24ec6cf426fbb7e1e2a2b37acb06
- SHA1
  
  10eb0400cb996edfa28b0bda63f564660151553e
- SHA256
  
  bf22490aa5ce5edb54e64d9156f8a2baae7fe8a9f03ed306f3f1b975d8933807
- SHA512
  
  798e0572fefe88ed33feaa9ebb4ad34dc58f85819aedd95983403970fc63b38dfe1bb4536e2d4b4350b4a00ac1db9a32b9585028970a8410fead8f510c9cf600
- SSDEEP
  
  1536:7Trye+0Ql9pObo8BHWfNXASFW08VAeOR2es:7T8Ybo8B21XASNMAeORk
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4