General
-
Target
b7dee59b78126ab03b18c571b7045e2c6b146062270463d150cbe82ad86f2947.exe
-
Size
203KB
-
Sample
240428-cb476adf36
-
MD5
60de9c3b301760961bf1664166ef0899
-
SHA1
baa84500caf3d32d99fea3e34c7f1d4ccecbf0a3
-
SHA256
b7dee59b78126ab03b18c571b7045e2c6b146062270463d150cbe82ad86f2947
-
SHA512
15c74ad5cbb775c22d487e0db7cb0d9857fbe1ef7c52870cb291d63e59872e2fa5dac61b73b6c96ec9f037cd7dc16424f1c46a52ff32a0bb3113ed32c4bfe737
-
SSDEEP
3072:P3w5UJlGMHmApaf6MCTQOjenfCvV3WX7n1PD52Rb6ORB:P3w5U3psfMTQ8xvVGX7n1PYl6OR
Static task
static1
Behavioral task
behavioral1
Sample
b7dee59b78126ab03b18c571b7045e2c6b146062270463d150cbe82ad86f2947.exe
Resource
win7-20240221-en
Malware Config
Extracted
stealc
http://185.172.128.76
-
url_path
/8681490a59ad0e34.php
Targets
-
-
Target
b7dee59b78126ab03b18c571b7045e2c6b146062270463d150cbe82ad86f2947.exe
-
Size
203KB
-
MD5
60de9c3b301760961bf1664166ef0899
-
SHA1
baa84500caf3d32d99fea3e34c7f1d4ccecbf0a3
-
SHA256
b7dee59b78126ab03b18c571b7045e2c6b146062270463d150cbe82ad86f2947
-
SHA512
15c74ad5cbb775c22d487e0db7cb0d9857fbe1ef7c52870cb291d63e59872e2fa5dac61b73b6c96ec9f037cd7dc16424f1c46a52ff32a0bb3113ed32c4bfe737
-
SSDEEP
3072:P3w5UJlGMHmApaf6MCTQOjenfCvV3WX7n1PD52Rb6ORB:P3w5U3psfMTQ8xvVGX7n1PYl6OR
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-