fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2

Sharing

Copy URL Twitter E-mail

General

Target
Electric.rar
Size 37.9MB
Sample240608-tl7jpsea65
SHA256 fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2
MD5 ed01b80849a848fc3c1285abb66cba4c
SHA1 23cc1b1f8dad47f86dabf71110f6ebfe9c854c12
SHA512 5e0d254690d7f13bf783e905c2481d73ba570fc623d4af4038b3c75fd4e09f45a3185357403d91b4b1d1d4a59ce03b37571b9383b296f5490eba240d690c1853
SSDEEP 786432:Hh5fSYddhTmrs+5ofByRhgYykOF0InSVgEI2/GfEDP6hgkmrvBmYLXWCi:BVSYzhqw2o5J6ISVgEvYo6hgk+fLXWB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Electric.rar
- Size 37.9MB
- SHA256 fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2
- MD5 ed01b80849a848fc3c1285abb66cba4c
- SHA1 23cc1b1f8dad47f86dabf71110f6ebfe9c854c12
- SHA512 5e0d254690d7f13bf783e905c2481d73ba570fc623d4af4038b3c75fd4e09f45a3185357403d91b4b1d1d4a59ce03b37571b9383b296f5490eba240d690c1853
- SSDEEP 786432:Hh5fSYddhTmrs+5ofByRhgYykOF0InSVgEI2/GfEDP6hgkmrvBmYLXWCi:BVSYzhqw2o5J6ISVgEvYo6hgk+fLXWB
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  ByfronHook.dll.txt
- Size 481B
- SHA256 bc9b870d92e2155dc0480d22e4093722af7a8b89ab1bcfc3a73b5130f8049985
- MD5 e3dcca7a93f4f4faccde944da1a107b1
- SHA1 20d852207d5946137cd26eec194f6ff981e77c74
- SHA512 aefd1b6ba29ad9cb12f95e5a2c27a1a503d52da0cdc9c47f1243eb6bb56e45788734b5b56910515e878a96436e498a1c67015a9ee55d58737eea54ff966fbe2c
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  Electric.exe
- Size 38.4MB
- SHA256 f3f320aaa33ac382221a897fd5659e8f2a10d7f2e3fa787ef096c87623ff1139
- MD5 a597071630f5e4d0c73e96dca55204ff
- SHA1 489ec09902c01d9b302e2d74cf55b251daa1a529
- SHA512 2ffa8955b5e10bce71db2c098557db074967bf6c02e31819bfd03d9ddac91c191c19cc1a557c2c1d839b96f649c8a837cadebdf7f31f5712918a26f0c06138f0
- SSDEEP 786432:74eK0Q/sYQF9dQuh2j6+s7LWB75zuOOojDorvS6tKzZLkrgY:02Q/sz9x2qHWB75i2yF4zSF
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral5 behavioral6
- Target
  blxstealer.pyc
- Size 40KB
- SHA256 429107a9b3716479f48147c1de776bb5e41d8a29de248893378e9483e1d70d96
- MD5 f91a2cad1ee847984dfde520d8dfb693
- SHA1 10d295589a036c1c8ba85db9b6067f381dc44603
- SHA512 8c9fbf28ae1134cc549356e4938278d1d77981c4a52e4170f13da7603a508ee05a01464764f806144f8d1a914f910b78932d7025b37fc040cc0dc94b1323542e
- SSDEEP 768:zUq+ewxN8R6PjYHA1LgKoX3d7bCsmySr5VUIHrseH53A2UcVAQnb0RwC:DKuRqt2ksmywVlflUcOQQR9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  README.md
- Size 1KB
- SHA256 032f9da262b974acb90aaa89202788ea9a7bda47bfd86137f559976cd802773e
- MD5 79d5c8aba08210134bb7eb9e1cf74791
- SHA1 6e6aad0f6ebe8b14a63e1b248b2ff018c92331bf
- SHA512 e50de436d90540a50eefc75fc4d120236736ca6352280522c7743b883dc2e3f97eb8116018eda922e81d3f30cc1626fb989bfdab15ae2c5bb57efccf7f08e32b
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  instructions.txt
- Size 782B
- SHA256 aaa8fe5b67a697da13c013e2f6c0b1f6270546c7465da89dd30b9bab2983e788
- MD5 f7d8dd204bba7189119619514bb39ad3
- SHA1 274974a03a1bf7a9a93bbc253612f91134e44ee6
- SHA512 f9b0d97efd246c912915efcdf2e4ed3d089939f1c3b49916f63c178dd5214f74ca56f205330fee425261938690378d004f86d1f3a23edea3bc3d3ee8caf01a6c
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  license.txt
- Size 5KB
- SHA256 78f9b5671c16bf36741046442d44d7ebd438d98fc48665313e8fab791d8efe64
- MD5 cf780f5c4be0b2b591af997c8bcd61e8
- SHA1 524a6b4d7ef16014aed5572f6eed2e17ddc2a7be
- SHA512 ec8b4bb8433a187efbcab06da90572cd53c5b83a175d8805af3d5663b8df6b6b760677b3b02e02371918158af81cdd498830c4a6ce8df88530f3b393621e631c
- SSDEEP 96:uE8hju6h4hCZxg9RgpEGsjXyj1imGF4bdXjk3KpaTkS659kQnx1dBHiSkF9tzK/:uEwjuKsgA4+XYdXjA+okS63vZBCSUze
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14