Overview

overview

7

Static

static

3

fn_cheat.exe

windows7-x64

7

fn_cheat.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fn_cheat.exe

  • Size

    20.2MB

  • Sample

    240525-qtft6sef67

  • MD5

    0b7799afd8e9f9e4ccefb1a7b20ddd63

  • SHA1

    551f5117d59658e333a2329c37a41d6008511709

  • SHA256

    edc42e1855dd8e6c704764235e401c8e056c83c9682753fd1f37f0807284dece

  • SHA512

    ed978fc413955d3acfb70fc8297676beab0c06642a82aba68632cb79a3585ecb74b6897b49fb45d3e107af92258e2973c7f60e965fdabd11a8bf29cc03bc074a

  • SSDEEP

    393216:pEkZQtss27GcFG8IW+eGQRg93iObIhRS/MLVrqy6oHd85Tv/:phQtsAcFG8IW+e5R49MhR9ZeKy5T

Score
7/10
pyinstallerspywarestealer

Malware Config

Targets

    • Target

      fn_cheat.exe

    • Size

      20.2MB

    • MD5

      0b7799afd8e9f9e4ccefb1a7b20ddd63

    • SHA1

      551f5117d59658e333a2329c37a41d6008511709

    • SHA256

      edc42e1855dd8e6c704764235e401c8e056c83c9682753fd1f37f0807284dece

    • SHA512

      ed978fc413955d3acfb70fc8297676beab0c06642a82aba68632cb79a3585ecb74b6897b49fb45d3e107af92258e2973c7f60e965fdabd11a8bf29cc03bc074a

    • SSDEEP

      393216:pEkZQtss27GcFG8IW+eGQRg93iObIhRS/MLVrqy6oHd85Tv/:phQtsAcFG8IW+e5R49MhR9ZeKy5T

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks