Overview

overview

7

Static

static

3

En1gma.exe

windows10-2004-x64

7

Resubmissions

28-04-2024 12:37

240428-ptyjjsgd2w 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    En1gma.exe

  • Size

    14.4MB

  • Sample

    240428-ptyjjsgd2w

  • MD5

    bde676b4ec4536486d9e9f374a268b50

  • SHA1

    5e8aed81494ac21e42f2fdc525690529778fe708

  • SHA256

    288b135291b3ec87788bb5b8cb219efff08cd05bff0e71190e241649de7f6c75

  • SHA512

    09d827c89bc9e1b6dc2291b1a9dc27f205fff262564ecfe612b08576ff398066bcd0169ff64c27fcefe71b1d3325227e7913120310f266f00aadb6e24aa27d49

  • SSDEEP

    393216:oiIE7YoPQjdQuslSq99oWOv+9fguz6L8/gw:J7rPQjdQuSDorvSYuzh/9

Score
7/10
pyinstallerspywarestealer

Malware Config

Targets

    • Target

      En1gma.exe

    • Size

      14.4MB

    • MD5

      bde676b4ec4536486d9e9f374a268b50

    • SHA1

      5e8aed81494ac21e42f2fdc525690529778fe708

    • SHA256

      288b135291b3ec87788bb5b8cb219efff08cd05bff0e71190e241649de7f6c75

    • SHA512

      09d827c89bc9e1b6dc2291b1a9dc27f205fff262564ecfe612b08576ff398066bcd0169ff64c27fcefe71b1d3325227e7913120310f266f00aadb6e24aa27d49

    • SSDEEP

      393216:oiIE7YoPQjdQuslSq99oWOv+9fguz6L8/gw:J7rPQjdQuSDorvSYuzh/9

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks