General
-
Target
Loader.exe
-
Size
6.7MB
-
Sample
240527-2gel5acd8y
-
MD5
fec24ccf2b85d85b131ecfc4bdda0746
-
SHA1
ee5de1e5a89d84d64d3aedb81179659b5d03e6db
-
SHA256
6d34cf62ae1124e407058500af4fc79a53efd3e4958c9b027c728876c25d1b37
-
SHA512
1bb71198b66bb28ec4770614de97f51fcd462f2372e57cee4707e2bd5c97efb6862a028507068f6e246375a5386f67e29245ac4282ffa07b3a91675683ee8281
-
SSDEEP
196608:ShZOFhN3eN/FJMIDJf0gsAGK5SEQRLuAKuzxu:Bq/Fqyf0gsfN6AK
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
Loader.exe
-
Size
6.7MB
-
MD5
fec24ccf2b85d85b131ecfc4bdda0746
-
SHA1
ee5de1e5a89d84d64d3aedb81179659b5d03e6db
-
SHA256
6d34cf62ae1124e407058500af4fc79a53efd3e4958c9b027c728876c25d1b37
-
SHA512
1bb71198b66bb28ec4770614de97f51fcd462f2372e57cee4707e2bd5c97efb6862a028507068f6e246375a5386f67e29245ac4282ffa07b3a91675683ee8281
-
SSDEEP
196608:ShZOFhN3eN/FJMIDJf0gsAGK5SEQRLuAKuzxu:Bq/Fqyf0gsfN6AK
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-