General

  • Target

    MM2ccDuper.exe

  • Size

    16.2MB

  • Sample

    240531-ryrmxacb54

  • MD5

    c468d50f656a15c78c24a71d28b89cc6

  • SHA1

    c189a35a462d86a4deeae99b6385d0921c4cad36

  • SHA256

    b31748ca0afdbf16e0bf795d6f0ca03f0b6530ec4971045db2f4aaf4897be581

  • SHA512

    62915921a377cd4d9eb697248052c86179d51e1829fa165674c3cc7a5c09112476b36f56805db6201b43f332d545439554a43afb31f34d57ad74d6ab014e6e52

  • SSDEEP

    393216:sv90+5gDkTh2Jp5MwurEUWjsrz7E5PKk9buK+x:69PvThidb8z7bkEK+

Malware Config

Targets

    • Target

      MM2ccDuper.exe

    • Size

      16.2MB

    • MD5

      c468d50f656a15c78c24a71d28b89cc6

    • SHA1

      c189a35a462d86a4deeae99b6385d0921c4cad36

    • SHA256

      b31748ca0afdbf16e0bf795d6f0ca03f0b6530ec4971045db2f4aaf4897be581

    • SHA512

      62915921a377cd4d9eb697248052c86179d51e1829fa165674c3cc7a5c09112476b36f56805db6201b43f332d545439554a43afb31f34d57ad74d6ab014e6e52

    • SSDEEP

      393216:sv90+5gDkTh2Jp5MwurEUWjsrz7E5PKk9buK+x:69PvThidb8z7bkEK+

    Score
    7/10
    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Target

      MM2ccDuper.pyc

    • Size

      45KB

    • MD5

      0b387ff8901029b9564bb4fca87f78dd

    • SHA1

      13b6d427fcfb0fbb6974e61ebac6d89ee826a1a9

    • SHA256

      8c3e48cde5fac76463e234d09eab47c4445977e7668084f89e8d36932006fe47

    • SHA512

      c00ffd0ef502768ad1a597a76fe972202630f9284a1571d0bacb79ca7d43e3d84fcbd93096ff58720c8fa8046843cfad2d50b954035fbcc4ba78fee9d22c47d5

    • SSDEEP

      768:n9JWeEmS6MSd2N/6hlJ99eaRoz/9LLUT/x26h6XRFvw1hE0EMqs6EDlhLx3k9:n9JWexSqdLhlJH5Cz/J0/xnh6BVw1hNm

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks