crealstealer | 460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403

Resubmissions

07/06/2024, 16:57

240607-vf8p9abc8s10

07/06/2024, 16:47

240607-vag1cacc6510

07/06/2024, 06:24

240607-g52rcaag9t10

Sharing

Copy URL Twitter E-mail

General

Target
TR4SH.exe
Size 21.8MB
Sample240607-vag1cacc65
SHA256 460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403
MD5 1ecea7c2cadbab8e2d578df23eaa5ce7
SHA1 100a31e4b2df453709719cfd606b5ded63c648aa
SHA512 d71a7f759d27c1620ff80abb94f6c9b556b23c02ee51eddbead221b0308f148f96adaa1f6c1bdcdcfb9231dbfd51810ea97d6496e1e15744614e095ac790e90c
SSDEEP 393216:ezQtsfh5+Kmr2pu0tTkQETS5vJQn+5PjDCA75umzTdrgDaMwUI6dA:ezQtsfX+Kmr2puIYQEW5hQ+d3fnJrewD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  TR4SH.exe
- Size 21.8MB
- SHA256 460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403
- MD5 1ecea7c2cadbab8e2d578df23eaa5ce7
- SHA1 100a31e4b2df453709719cfd606b5ded63c648aa
- SHA512 d71a7f759d27c1620ff80abb94f6c9b556b23c02ee51eddbead221b0308f148f96adaa1f6c1bdcdcfb9231dbfd51810ea97d6496e1e15744614e095ac790e90c
- SSDEEP 393216:ezQtsfh5+Kmr2pu0tTkQETS5vJQn+5PjDCA75umzTdrgDaMwUI6dA:ezQtsfX+Kmr2puIYQEW5hQ+d3fnJrewD
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2