Overview

overview

10

Static

static

10

sysEXEC/bo...0x.jpg

windows10-2004-x64

3

sysEXEC/bo...rl.png

windows10-2004-x64

3

sysEXEC/deter.dll

windows10-2004-x64

1

sysEXEC/quickDrop.dll

windows10-2004-x64

1

sysEXEC/sysEXEC.exe

windows10-2004-x64

7

Creal.pyc

windows10-2004-x64

3

Resubmissions

18-06-2024 09:11

240618-k5wrwa1cmr 10

18-06-2024 08:50

240618-krmxtazfkr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sysEXEC.zip

  • Size

    18.8MB

  • Sample

    240618-krmxtazfkr

  • MD5

    b64337c77cb62ff48d87955db53a863f

  • SHA1

    e3c23ab913f0fbe28e2be66f643085b3cdb57e55

  • SHA256

    1b0f8b7a56eedd6416a91dff43c83a15ae2e4ddb966412e5abdc1acefeb8f6c2

  • SHA512

    c5b1e678b65b485daf313541e43de1ae57a55ee06e48e9b6084c8dfb9702248ffd2f9d976a525ad4acaf486d05cad764c77231ad952635bf36a969f75d3bee89

  • SSDEEP

    393216:7oZJFDY1RYfK3/ayMJ/sK43Z7/oSQlo0ztn17fOq:7oZJq1RYfKDMJ/sK4pTobllzt17Wq

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      sysEXEC/bootstrapper/b0x.dll

    • Size

      3KB

    • MD5

      1626aaec1aab4f2fbd1dd1af7639c216

    • SHA1

      fd74daa709a3f55612e045cd6fbd00dd62a8ee1d

    • SHA256

      9efb1018fb6edff77c2396383b1eaa386fd448a19d3cba540abfc1f76e13024f

    • SHA512

      edfab477e6633aff046a7bcd3e8f2f492f5fb35d038f43b9d557f7744acc3b224072028a8479c998b3ed747d29fe3462c8241c5036a579425bb38bd3d9ac3c7b

    Score
    3/10
    behavioral1

    • Target

      sysEXEC/bootstrapper/curl.dll

    • Size

      158KB

    • MD5

      7f5344e42af2fb868ab54894d022bb45

    • SHA1

      524e1ae9c4995973587f6eca9f574a8bec23a565

    • SHA256

      dc715417d7eaff6b621fbbacd94471e3ced2e4f4b70ba4dbc3ec00f655fe301b

    • SHA512

      573265aacd7add8147fcf6863c1c370ebb86faf37280d95a77336865b4f138a0b53efb4b09854a300bb824d481227684e95653b4fe1e2edb8115531b6191dc90

    • SSDEEP

      3072:uXSlX3QHNU4tvpl7y4HJEVqoa90c+gfDXcPqU7R3wTYNbOXPPT74blg:gSl3YrNpVy8yqoa99FXcF7MYIXnP4by

    Score
    3/10
    behavioral2

    • Target

      sysEXEC/deter.dll

    • Size

      2.4MB

    • MD5

      e0035f1415ad57390e035a1924e66699

    • SHA1

      aea268dd8cde0f81847b5faf31914e5def3e3905

    • SHA256

      77f70788f86eb2118c62505b12857fc9ecec67ddda00c9ae763e30f4d2001973

    • SHA512

      dae404a831f3acb504210aecf24838ee4a86f46ff389c090dce85d7f3dcd23395cd4f475143b619b142319e0b610a063d07ab51a26aa3a5b08d48e41112e6a53

    • SSDEEP

      49152:fQB8FXngzuLOerj6QSKFsZ+5xtRvBZmYxx3zpWSkdP1uYMOD6Gy2MS:fQB8lgzu9f6QSKFnBp/P9xs1uYMy6dy

    Score
    1/10
    behavioral3

    • Target

      sysEXEC/quickDrop.dll

    • Size

      2.0MB

    • MD5

      0911c00b81b90ea126d46a1bd5c2933f

    • SHA1

      bf59ae80d8b72ad1d805ee806803d932bb02044a

    • SHA256

      dafbdacac1b68e0d615bd5d6550a472800e37f1c8cbda9064c61cefb4c29435d

    • SHA512

      43442e93725024c0b98c6d958f995830436adb676ab1d6b12e9fbf9b6bf78dc02b9ce7ddeef957b61105440349b1b7d88c8db4951ad344796b891d2baf113bf9

    • SSDEEP

      24576:AqTkBkEU283mDQYaL/el5XOgE3LWC1MsDvHKuzPgqf/r4MOKbcQzKhkziZ68EbaN:lmkE6Wgel5XGZvRPLNO5QzK3g8EehHik

    Score
    1/10
    behavioral4

    • Target

      sysEXEC/sysEXEC.exe

    • Size

      14.5MB

    • MD5

      02d12d780b93209fad2a6dc29716b278

    • SHA1

      d425f1c11190044e07be7c87845a0a89203fec9e

    • SHA256

      1302f2c7054ea7194ce07428af0c2fa00c46e2d27fb96e7734f09cdab139b1a5

    • SHA512

      6f9c5a62742049f0218ddcf59ef880f231809010cbad3954197616036828839893b2af38137c419732f2a3dda8f41b32a8ad4845b48c1bb506f52ad0448241b1

    • SSDEEP

      393216:LEkZQ0dQuslSq99oWOv+9fgWtRT7k3he:LhQ0dQuSDorvSYWtl74h

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral5

    • Target

      Creal.pyc

    • Size

      82KB

    • MD5

      85b513e06d60766bf9d2e324fcce2108

    • SHA1

      ba1af8ec4aac32f5333f39a73d16cc8da7307399

    • SHA256

      6bdebac7fd9cd105c7d52cdc99e88e1dd486882509fccfcd2aed92a51ab17379

    • SHA512

      01df4739559d10b2b840103b5d3a003ce4afbb42fe5fed18c43a1d894b8719cfb92813d370f21c1fbfca09c02ff5f6715479b23b8dfc3a43407576b241784b25

    • SSDEEP

      1536:MupDrbe3uzTZMB7aK1ieL7iVX9hcuhFwNfb2GJjOZRJ:bpDve3uz0BkSGN9iOzOjsP

    Score
    3/10
    behavioral6

MITRE ATT&CK Enterprise v15

Tasks