68a7a77e1e9a004bc9e823d16c808a3129b17d3600a6fc13f0d34f94f4b0c22a

Sharing

Copy URL Twitter E-mail

General

Target
68a7a77e1e9a004bc9e823d16c808a3129b17d3600a6fc13f0d34f94f4b0c22a.rar
Size 5.6MB
Sample240613-brbecasfjn
SHA256 68a7a77e1e9a004bc9e823d16c808a3129b17d3600a6fc13f0d34f94f4b0c22a
MD5 49ba2dc32416a7c1ce483f54641fd2ee
SHA1 8da37b42b4d6371631e88ed9fa35578d229c7b62
SHA512 00a0ca994f7e8fff124f70d7cb9cbea06802c874b3411ef397f108461647ee3a1ae7329da81a5c47ffaba3ae871b1118b66a9bbfd92a87d5c98c5fdb7d2c6289
SSDEEP 98304:S6kCT2LuFfjpitn6kCT2LuFsjpitMLyODkR37+jdmwxjTXUrWNLkpyKT7tf4:Rk7aF9k7aFSLyODkt6gwlTECNLrKVQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  ExtractAll/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk
- Size 2KB
- SHA256 adcc446e1b1cd00d20c56b3dd654bef51128875a76b24903d18270b09b7da081
- MD5 56cc3193b2289919b689f837baeb6e6c
- SHA1 d50854ba733fda66cf8ce29f60312ee10c1dca89
- SHA512 37891494577ac912291f7af92d625b4a8399137f95134506686ac3a116e4f0289d13ecb04b0d14cecc8a239f0238776780eaee1609d24ff5cffe63bbe8468e01
- MD5 SHA1 SHA512
Score

8^/10

execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2
- Target
  ExtractAll/MyCover3.jpeg
- Size 925KB
- SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
- MD5 0adb9b817f1df7807576c2d7068dd931
- SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
- SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
- SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ExtractAll/MyCover4.jpg
- Size 83KB
- SHA256 fa7b80f3d060c663691f7ede61847d7e1514145e569732af173f61e55ff6e72b
- MD5 2bca0eb97a7c0825910517162251471c
- SHA1 52d878223c596cb2f130514125e427f6f87d686b
- SHA512 c2a5c544ac5e35e7697c420a4c63a856756b4ffa8c361e497ffc9d705d08436ed3a5c768756896e3b75100d67bc68e06b563d3f34c2e9b9fb4ff09440a0bda18
- SSDEEP 768:AjpppppppppepppppppppepppppppppepppppppppepppppppppNpppppppppepT:AE99+duVpx999+duVpx9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral5 behavioral6
- Target
  ExtractAll/Readme/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk
- Size 2KB
- SHA256 adcc446e1b1cd00d20c56b3dd654bef51128875a76b24903d18270b09b7da081
- MD5 56cc3193b2289919b689f837baeb6e6c
- SHA1 d50854ba733fda66cf8ce29f60312ee10c1dca89
- SHA512 37891494577ac912291f7af92d625b4a8399137f95134506686ac3a116e4f0289d13ecb04b0d14cecc8a239f0238776780eaee1609d24ff5cffe63bbe8468e01
- MD5 SHA1 SHA512
Score

8^/10

execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral7 behavioral8
- Target
  ExtractAll/Readme/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).pdf
- Size 3.7MB
- SHA256 c648b9cbe10ac1726c4dd1845413ab4841950e892e6443b99fed662618c1e1a8
- MD5 a7653852d9fbc23db8d3ec5ba7afbeb3
- SHA1 b58e16719ede8a0c35765e294ecfd9945d423e82
- SHA512 f97fc17be4dfd8ab5f662df16a808018189eeed344bf70b59bf03b1239edd33d04b631a93ac8a62676571cc16a9c0361cbb59c63283b1e223b781e28dad4024b
- SSDEEP 98304:Gzmv1E+J6yWHcHhjmpjE4Sn30HLVhZxXyz6PxyGj:BS+UAxmpjun30H7qCyGj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  ExtractAll/Readme/MyCover3.jpeg
- Size 925KB
- SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
- MD5 0adb9b817f1df7807576c2d7068dd931
- SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
- SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
- SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  ExtractAll/Readme/MyCover4.jpg
- Size 83KB
- SHA256 fa7b80f3d060c663691f7ede61847d7e1514145e569732af173f61e55ff6e72b
- MD5 2bca0eb97a7c0825910517162251471c
- SHA1 52d878223c596cb2f130514125e427f6f87d686b
- SHA512 c2a5c544ac5e35e7697c420a4c63a856756b4ffa8c361e497ffc9d705d08436ed3a5c768756896e3b75100d67bc68e06b563d3f34c2e9b9fb4ff09440a0bda18
- SSDEEP 768:AjpppppppppepppppppppepppppppppepppppppppepppppppppNpppppppppepT:AE99+duVpx999+duVpx9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral13 behavioral14

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Deletes itself

Executes dropped EXE

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Deletes itself

Executes dropped EXE

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14