General

  • Target

    AutoReferrals.zip

  • Size

    1.2MB

  • MD5

    00e589d42d8513f01cbbf90ce9e9909a

  • SHA1

    b809ad48e594b4d32dcde406aff1063b8711ad83

  • SHA256

    5263001b545bbafcd584a3f02685e03a104267993e0acd13ab612ba8a55ba50c

  • SHA512

    1216df3f49a0234876061372e76175784de89c657649789c09cea27cd4f93277e845dcc15db79fa700b87077d984129db607d86921d99c0fa21ef0c1a2d0cf76

  • SSDEEP

    24576:iyB1MVNRdo+g4XYko58kuxVlIP0TROxyB1MVNRdo+g4XYko58kuxVlG:TXMjgCkqjwIBXMjgCkqjG

Score
10/10

Malware Config

Signatures

  • An infostealer written in Python and packaged with PyInstaller. 1 IoCs
  • Crealstealer family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • AutoReferrals.zip
    .zip
  • AutoReferrals.py
  • README.txt
  • install.bat
  • install_python.bat
    .bat .ps1
  • src/backgroundContainer.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    0edd5e641156d95efbd92a5a0d55816c


    Headers

    Imports

    Exports

    Sections

  • src/bot_main.py
  • src/msvcr90.dll
    .dll windows:6 windows x64 arch:x64

    b5e469ab933cfa7c7acd3321b655e61d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • src/registryFix.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    0edd5e641156d95efbd92a5a0d55816c


    Headers

    Imports

    Exports

    Sections

  • start.bat