General
-
Target
My_Singing_Monsters_Supernova_Histories.exe
-
Size
14.4MB
-
Sample
240802-w2j5fszcph
-
MD5
f73d86d8e4a0ff4046a0f830b2908adb
-
SHA1
98747291e14f9a5ab1a1f672b82721cd542f805a
-
SHA256
8b9edb3a35c74557d8381368f0ab0ed64f3e20b2e2f1e9fe22f4f3edf89d556c
-
SHA512
ae07659435de558a2cac6b8f6682e7d11e47eb4439c3bb329a00b658993b1582dd243df3a5577d8d6b276311725a2f38e40f413087f7a75ae48a21c34cbb8b4a
-
SSDEEP
393216:LiIE7YoPQQdQuslSq99oWOv+9fgcTeiUW/row:47rPQQdQuSDorvSYcTeo/5
Malware Config
Targets
-
-
Target
My_Singing_Monsters_Supernova_Histories.exe
-
Size
14.4MB
-
MD5
f73d86d8e4a0ff4046a0f830b2908adb
-
SHA1
98747291e14f9a5ab1a1f672b82721cd542f805a
-
SHA256
8b9edb3a35c74557d8381368f0ab0ed64f3e20b2e2f1e9fe22f4f3edf89d556c
-
SHA512
ae07659435de558a2cac6b8f6682e7d11e47eb4439c3bb329a00b658993b1582dd243df3a5577d8d6b276311725a2f38e40f413087f7a75ae48a21c34cbb8b4a
-
SSDEEP
393216:LiIE7YoPQQdQuslSq99oWOv+9fgcTeiUW/row:47rPQQdQuSDorvSYcTeo/5
Score9/10-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-