hxxps://top4top[.]s3[.]eu-central-2[.]wasabisys[.]com/anonymous/6oii4cLginWtYnQ_1722410943[.]rar?response-content-disposition=attachment%3B%20filename%3D%22TOOLS[.]rar%22&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=B77KQ8UE8YY8QFEKNSEN%2F20240801%2Feu-central-2%2Fs3%2Faws4_request&X-Amz-Date=20240801T205729Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Signature=3b5a55191dd2b5501a7f62d06e0698f7e2277a27166870a66d00445b146c353a

General

Target

https://top4top.s3.eu-central-2.wasabisys.com/anonymous/6oii4cLginWtYnQ_1722410943.rar?response-content-disposition=attachment%3B%20filename%3D%22TOOLS.rar%22&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=B77KQ8UE8YY8QFEKNSEN%2F20240801%2Feu-central-2%2Fs3%2Faws4_request&X-Amz-Date=20240801T205729Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Signature=3b5a55191dd2b5501a7f62d06e0698f7e2277a27166870a66d00445b146c353a
Sample

240801-zshf2szhqf

Score

9^/10

Malware Config

Targets

- Target
  
  https://top4top.s3.eu-central-2.wasabisys.com/anonymous/6oii4cLginWtYnQ_1722410943.rar?response-content-disposition=attachment%3B%20filename%3D%22TOOLS.rar%22&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=B77KQ8UE8YY8QFEKNSEN%2F20240801%2Feu-central-2%2Fs3%2Faws4_request&X-Amz-Date=20240801T205729Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Signature=3b5a55191dd2b5501a7f62d06e0698f7e2277a27166870a66d00445b146c353a
Score

9^/10

collection credential_access discovery execution persistence privilege_escalation pyinstaller spyware stealer upx
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1