Overview

overview

10

Static

static

10

Creal.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Creal.exe

  • Size

    17.2MB

  • Sample

    240724-leew4s1hkh

  • MD5

    e970cf72226f88874600e25012891156

  • SHA1

    ff016a986557ec18fcf58200c400398eb7b14e4d

  • SHA256

    2cc5696a8a356753ef582bcf0b32b8b8f74dfa4290502355d63a0ff9e7e5539a

  • SHA512

    d3bd41f6e3906ac5d2dac689180963adabeb178b030593ab1d35cf2555c6b1516a6f3e79da31f18804d260bbe98fe53c52c47c0952326722c40d2c1c0986dcab

  • SSDEEP

    393216:FEkwAci2xY1+TtIiFg0VBSRW8E5u6bGaL6gIF4E5IXvCI9:FI+GY1QtI6YRW8IuyLeWE5IXqI9

Score
10/10
crealstealercredential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      Creal.exe

    • Size

      17.2MB

    • MD5

      e970cf72226f88874600e25012891156

    • SHA1

      ff016a986557ec18fcf58200c400398eb7b14e4d

    • SHA256

      2cc5696a8a356753ef582bcf0b32b8b8f74dfa4290502355d63a0ff9e7e5539a

    • SHA512

      d3bd41f6e3906ac5d2dac689180963adabeb178b030593ab1d35cf2555c6b1516a6f3e79da31f18804d260bbe98fe53c52c47c0952326722c40d2c1c0986dcab

    • SSDEEP

      393216:FEkwAci2xY1+TtIiFg0VBSRW8E5u6bGaL6gIF4E5IXvCI9:FI+GY1QtI6YRW8IuyLeWE5IXqI9

    Score
    9/10
    credential_accessdiscoveryspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks