General
-
Target
loader.exe
-
Size
7.3MB
-
Sample
240620-y3rxsszelr
-
MD5
e4b286423740d4f4829ce2cb0eaa84d2
-
SHA1
98ae80a330920c598743690c2d2a2dac4248eeda
-
SHA256
fe6511f0175fc0f7e50e034e2bc3d43ce0488348e6a76919ef921db512535fe8
-
SHA512
febfcd2a3dd60cb4d369f9b4d793a1acef4337f2168294c218849d51c82c2785985bda794a581976efb6b93299199c887e2c13488377adf695c214402952a210
-
SSDEEP
196608:HEYS62/OshoKMuIkhVastRL5Di3uh1D7JU:kYSv/OshouIkPftRL54YRJU
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
loader.exe
-
Size
7.3MB
-
MD5
e4b286423740d4f4829ce2cb0eaa84d2
-
SHA1
98ae80a330920c598743690c2d2a2dac4248eeda
-
SHA256
fe6511f0175fc0f7e50e034e2bc3d43ce0488348e6a76919ef921db512535fe8
-
SHA512
febfcd2a3dd60cb4d369f9b4d793a1acef4337f2168294c218849d51c82c2785985bda794a581976efb6b93299199c887e2c13488377adf695c214402952a210
-
SSDEEP
196608:HEYS62/OshoKMuIkhVastRL5Di3uh1D7JU:kYSv/OshouIkPftRL54YRJU
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories
-