General
-
Target
Saturn Beta.zip
-
Size
22.1MB
-
Sample
240704-wvydhasanj
-
MD5
d7129de2118af9ff5183243b2ca48f06
-
SHA1
53218f1def5974207e9f4737fbede22745d6bfbd
-
SHA256
f0372f19d64916712c73c1fcbe05d2ead6d53831f2d8523bae48dcb992faf678
-
SHA512
6fb0191fdca7b6c07910e375a88ae28686bda3520caf3482a5918e3931fbd2cef05f1cacaf3bfd0c1b8a0c2a6ecef571e8a7b0a241309154c3ed96d8aad498e8
-
SSDEEP
393216:EtaPrM0HPkyG+K6ZE3kAqjnyNJKTQJ4hqs15FNbEuCsXAobC3sWkpNQZqHX/:FrM0HgKDj6Jgqs13NpCkA30N5HP
Malware Config
Targets
-
-
Target
Saturn Beta/saturnbootsrapper.exe
-
Size
52.2MB
-
MD5
a9e1bc56479e53b1836459e9a9e5c551
-
SHA1
93cdd7964cdbaede24f958d7030d1f6906708a4b
-
SHA256
80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda
-
SHA512
0a266e6908916e6a4aa86800dc55a724fcbac64df211cf127d7c0de3db511438ad543954875c4db0cad0732bf69885019799c19b3b6bf9fc2d8de0ebfca4be0e
-
SSDEEP
393216:uWvz+q3VyoyUIC9urEUWj5EnBSVkRIrY87FNlqrMvxmouin93vt6a9kW/W:Pz+q30QdbQzcY87FziMZmylV6BM
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-