crealstealer | af087e44b9920b0dd59aac8a366a167d5f5457e608b6616450d73956294a9500

General

Target

Cleaner.rar
Size

17.9MB
Sample

240508-1s8tnshe8w
MD5

a5771ca0c51bc0214cdca8388fd8b9b3
SHA1

cfcbe15396b36f92377511926fe08ddacdd66def
SHA256

af087e44b9920b0dd59aac8a366a167d5f5457e608b6616450d73956294a9500
SHA512

10bbbdcba9fc259d763163f50a0878e1d9a2866fbfe11f7cf4936d658b35863e69934aa8be9e2e5b27b83ca038f4a6e1b857b2d49e4506bcec57a1c2711b09a7
SSDEEP

393216:qxsxQP6Z84bdg2IemDJHyHfvS5DyKnot2OTuL9Z9OEpr4h+nTXRbpxLC2wzNGURD:XxE084bdgsm359n49GZ9OEpC+znxLStH

Score

10^/10

Malware Config

Targets

- Target
  
  Cleaners/applecleaner.exe
- Size
  
  3.6MB
- MD5
  
  f96eb2236970fb3ea97101b923af4228
- SHA1
  
  e0eed80f1054acbf5389a7b8860a4503dd3e184a
- SHA256
  
  46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172
- SHA512
  
  2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7
- SSDEEP
  
  98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Modifies Windows Firewall
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  Cleaners/applecperm.exe
- Size
  
  14.3MB
- MD5
  
  9405b56af4d2bd0546ed27ed1d68b1ab
- SHA1
  
  8c7d5c8563f621c2cffafc9ccd4a156cfb7ec8f8
- SHA256
  
  6e997d7cdd07a8c173b569bedda6aaaf1b5ac10e5391a98c2f4593c5fc284b30
- SHA512
  
  96c6b04730ba00d6ba1bc6f90fa1e484594a39fd83b4c22a2b8646cfb1220c20cf5dc819e63ef3100ca66a3c302eb00b1d3b564e034d34b7995c20c9befc21d4
- SSDEEP
  
  393216:aiIE7YoPQMidQuslSq99oWOv+9fgEIlIQvew:D7rPQ3dQuSDorvSYEIpvf
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral2
- Target
  
  Cleaners/clean1.bat
- Size
  
  578KB
- MD5
  
  471546f6de675803f384262a9d0d17de
- SHA1
  
  da7ae8fc83f5feee8bf16517f04fbc20d8b61cfa
- SHA256
  
  880dc9c7a7291a729d4ce07bc300d90665f262834cfb6501505ab3061b7a06dc
- SHA512
  
  010d32d05ee599f67b036d1852d8deac0422d168ed68ad4b5147bb858252f348b882d563efd087922b474915ada9c39852c25e569de408bdd4a4d6fb7ebefbbb
- SSDEEP
  
  1536:5iYLmcHjgkpYLmcTzg8gcDRnvplQL5LvLpLjLwazhztzh4Wo:gYScH9YScTzg8gURnvpWzhztzhDo
Score

5^/10
- Drops file in System32 directory
behavioral3
- Target
  
  Cleaners/clean2.bat
- Size
  
  854KB
- MD5
  
  181b6db3092989609f7878c4e51aa220
- SHA1
  
  c2f2eb7aa2ad301f76598164daaf04574846c58d
- SHA256
  
  798f56c1a6e8f546d57386f93fba2c138b687a002c89535e114ceb938a33970d
- SHA512
  
  e9ebfa63520d9b00516deb11cdfda317fcb8edeafb453001ee999ba0bfb06f0b80ff026ba5b80fe8d78d80313501e814f94070de5dfcbcba8d131591ea37ba4f
- SSDEEP
  
  6144:XtJlSvOPgunY1X7G4LsMrkDWUpWOlBkORX:9qvOPgunY1K4LsMrkDWUpWOlBkORX
Score

4^/10
behavioral4
- Target
  
  Cleaners/clean3.bat
- Size
  
  343KB
- MD5
  
  3de20f421e4b66e61c52633f5207d81c
- SHA1
  
  91e2413af1bef8e7739d2185f4c69b4e11b35914
- SHA256
  
  2c36eb24e6479bb955c04569b6cf9d30a8ac9a56fe15cb65a7ff24709b8ea021
- SHA512
  
  94cad8e43aa70cd5f222f4d6997360b0ae7c2f3b89b5ef1244dd8b5f7825da6ab724ba8ead5aa3a1b04ffb5e6650787424226cc4f31602cf45112dd577dc1492
- SSDEEP
  
  1536:7Z/gxTrKL5LvLpLjLwO6WTaPAyz7AeOreL5LvLpLjLwmD7o0PeEJJPMCO:7VgxTr4+PBz7AeOrKo0PA
Score

1^/10
behavioral5
- Target
  
  Cleaners/clean4.bat
- Size
  
  853KB
- MD5
  
  d4c34b33b42ce1a0aa1227fa3a768124
- SHA1
  
  796606e45d27fd332c6143f6f09cef3c8a522493
- SHA256
  
  d2f5b505cd5a6baaabb9d1f51f6b5800139034db44e220f83b44cd66b3197b38
- SHA512
  
  33ffd3944bfe182cfcd9f40bb73af997db37692f6a769953e931af24acbebaa2a698254860fc2095cd507d84a2437907016cc8d1bd3614cf6899f6428ef86ff1
- SSDEEP
  
  6144:5tJVSIIgunYMX7GmOgDsMrODuUpW/kBkOR1:X6IIgunYMKmOgDsMrODuUpW/kBkOR1
Score

1^/10
behavioral6
- Target
  
  Cleaners/clean5.bat
- Size
  
  275KB
- MD5
  
  2b043c717d3e6336adfdd1cb074bbe88
- SHA1
  
  c08abb3f64f9e22a73d9e7032a49448a0180d7c2
- SHA256
  
  709731808b76e8cb0c479131c862281ca9bc611cf6936b0af195feb2320fd1c2
- SHA512
  
  e9967d207fdb6cf8e6d17481f4daa9acf76f9a11bcb71bb7bddaf44a54416eadbedc43c6ba31e93cb9b1512cb316a41ec3062c6d7e2794a01233ee8d3bd739d2
- SSDEEP
  
  768:5WvY2SxOgxaLobPjlP0RnFGwJh7hbPEPdrdHTL9KEJm/R450O1vNZmVWnrfrdPwh:5ge1mIbrd1w04g/36fL5LvLpLjL5KL2v
Score

1^/10
behavioral7