crealstealer | a3b7ca2eedb0fc1c76c48264a0c863e9cda615d5d41adbc7a16360e6d407f738 | Triage

Resubmissions

21-07-2024 21:54

240721-1sp2kawgkg 10

30-10-2023 09:49

231030-ltj5dacb8v 10

Sharing

General

Target

Adamx_Tweaking_Utility_Version_10.04.23.exe
Size

14.7MB
Sample

240721-1sp2kawgkg
MD5

243c0655be95227b8295be97789feb97
SHA1

a356795526b56cac6cdb7130586ec58955c2cc20
SHA256

a3b7ca2eedb0fc1c76c48264a0c863e9cda615d5d41adbc7a16360e6d407f738
SHA512

406e3bab3bc28f95d11c0d55cc2a0ff5107b1fd4e62a18fa97dcf9138a8378247f74084d29f5a3bd1a7d635719ba1fab2ad2409abb8b01858eae359b20a6c464
SSDEEP

393216:pJBtZiIE7YoPQ6dQuslSq99oWOv+9fgGISPeiS:pJBtm7rPQ6dQuSDorvSYGIhi

Score

10^/10

crealstealer pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  Adamx_Tweaking_Utility_Version_10.04.23.exe
- Size
  
  14.7MB
- MD5
  
  243c0655be95227b8295be97789feb97
- SHA1
  
  a356795526b56cac6cdb7130586ec58955c2cc20
- SHA256
  
  a3b7ca2eedb0fc1c76c48264a0c863e9cda615d5d41adbc7a16360e6d407f738
- SHA512
  
  406e3bab3bc28f95d11c0d55cc2a0ff5107b1fd4e62a18fa97dcf9138a8378247f74084d29f5a3bd1a7d635719ba1fab2ad2409abb8b01858eae359b20a6c464
- SSDEEP
  
  393216:pJBtZiIE7YoPQ6dQuslSq99oWOv+9fgGISPeiS:pJBtm7rPQ6dQuSDorvSYGIhi
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  Creal.pyc
- Size
  
  29KB
- MD5
  
  5f3bb95ca8adfdf1fcb79f63bd51722f
- SHA1
  
  c083a2e5768c5d8ea1cf32585b9464bd1390b273
- SHA256
  
  2559c00f81fb713ddaf533918e23f4003cf923650590ba389a4f2202a8be6826
- SHA512
  
  d8eb9755266206b5732a49c5d13d7b4f433d07c4bf4848a1d4155a9107e6978b21cf4ab046b68cefbf2342a6b7ae39663b12d686450fa12992a65588edf3489f
- SSDEEP
  
  768:3+lVSjnrw2VsfNEiyAuMMIfznTZMdpV7ISrx5HwtvK17Cvr:30SDrKe3uzTZMB7aK176r
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

pyinstallercrealstealer

behavioral1

behavioral2

behavioral3

behavioral4