crealstealer | 460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403

Resubmissions

07/06/2024, 16:57

240607-vf8p9abc8s10

07/06/2024, 16:47

240607-vag1cacc6510

07/06/2024, 06:24

240607-g52rcaag9t10

Sharing

Copy URL Twitter E-mail

General

Target
TR4SH.exe
Size 21.8MB
Sample240607-g52rcaag9t
SHA256 460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403
MD5 1ecea7c2cadbab8e2d578df23eaa5ce7
SHA1 100a31e4b2df453709719cfd606b5ded63c648aa
SHA512 d71a7f759d27c1620ff80abb94f6c9b556b23c02ee51eddbead221b0308f148f96adaa1f6c1bdcdcfb9231dbfd51810ea97d6496e1e15744614e095ac790e90c
SSDEEP 393216:ezQtsfh5+Kmr2pu0tTkQETS5vJQn+5PjDCA75umzTdrgDaMwUI6dA:ezQtsfX+Kmr2puIYQEW5hQ+d3fnJrewD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  TR4SH.exe
- Size 21.8MB
- SHA256 460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403
- MD5 1ecea7c2cadbab8e2d578df23eaa5ce7
- SHA1 100a31e4b2df453709719cfd606b5ded63c648aa
- SHA512 d71a7f759d27c1620ff80abb94f6c9b556b23c02ee51eddbead221b0308f148f96adaa1f6c1bdcdcfb9231dbfd51810ea97d6496e1e15744614e095ac790e90c
- SSDEEP 393216:ezQtsfh5+Kmr2pu0tTkQETS5vJQn+5PjDCA75umzTdrgDaMwUI6dA:ezQtsfX+Kmr2puIYQEW5hQ+d3fnJrewD
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  TR4SH.pyc
- Size 48KB
- SHA256 4eb471cb563f610e15443009a2cf93f0dde6e151ab0e05acfab67563e40cadbc
- MD5 7668979f3a8e3bfb1f6606af4ab81628
- SHA1 eb5637b1be97af8da3f323008be971eeb2bab6e7
- SHA512 78be9b5759530ca7d6e6dd484b6fdda4751126e6eefbc6d5f879a7b9a5d745200fc21799bc7021e170f53db91fd8c0ad4b2f9a5c47b4ee0f330f77d3ef4b03bc
- SSDEEP 768:pxu+/nZtgH7+96XVYVxc8X+9xkIsmzw2QqCBpJS68CZxmtreQM3lU0XnW6z:fW+yVicjjTw2QqCjJJatK93BXnWW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4