General
- Target SecuriteInfo.com.Python.Stealer.1405.21796.6855.exe
- Size 11.0MB
- Sample240610-vx51patfph
- SHA256 79f053cb05c6097824c4ed268c5534af8d93a7d4a2ab9ac6045606d10ba80df0
- MD5 eecc60d506648d35a51c0f3a37c3e8f7
- SHA1 4f1ba2a9356f1df096446a7c502b3c749b219f77
- SHA512 8044cbd8116cab7a4252e40a109dbfcc0312230145a19d14eaa6e608500bed9425efe221a604c1d84d4b27f3e0b984902da1b9c5290346c89c078a2623133e5b
- SSDEEP 196608:wh+gnEkfbdqBA1HeT39IigwdeE9TFa0Z8DOjCdylLhYMfnSEOGQfkdoXKh:sEkfb4q1+TtIiFUY9Z8D8CcldlqtNbX4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Python.Stealer.1405.21796.6855.exe
Resource
win7-20240215-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target SecuriteInfo.com.Python.Stealer.1405.21796.6855.exe
- Size 11.0MB
- SHA256 79f053cb05c6097824c4ed268c5534af8d93a7d4a2ab9ac6045606d10ba80df0
- MD5 eecc60d506648d35a51c0f3a37c3e8f7
- SHA1 4f1ba2a9356f1df096446a7c502b3c749b219f77
- SHA512 8044cbd8116cab7a4252e40a109dbfcc0312230145a19d14eaa6e608500bed9425efe221a604c1d84d4b27f3e0b984902da1b9c5290346c89c078a2623133e5b
- SSDEEP 196608:wh+gnEkfbdqBA1HeT39IigwdeE9TFa0Z8DOjCdylLhYMfnSEOGQfkdoXKh:sEkfb4q1+TtIiFUY9Z8D8CcldlqtNbX4
- MD5 SHA1 SHA512 SSDEEP
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.