Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/08/2024, 00:01
General
-
Target
2024-08-03_1ed4f7087d455ac137f304bfa417def5_avoslocker_qakbot.exe
-
Size
1.2MB
-
MD5
1ed4f7087d455ac137f304bfa417def5
-
SHA1
c2f60d7c5bb26e297aff9118d3357b475272a96f
-
SHA256
20f2746e7f5ce76ba65f0fdb57375ad5822942178f8eb940f6206d7ef982b408
-
SHA512
b1b933ebc2edddb65cb28393258e09ab5e06c8de85f5dbb7144fb442f2540bff84b3da7f627d0dd4380df034d201affbdd90fabbacd4ce7769b05ad633b9ef8c
-
SSDEEP
24576:yzd9Sm6s3SB4VbhzGcHb0bBhXxtyesOlU0YOTAXnA91IV7HExDaIg:yzTSmvdcwb0VhXHlrTKA91IV7HExOIg
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-03_1ed4f7087d455ac137f304bfa417def5_avoslocker_qakbot.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-03_1ed4f7087d455ac137f304bfa417def5_avoslocker_qakbot.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
22B
MD563430b6078d0ad87ee0650a8e15249b6
SHA1bd488794fb05f02c559257185b80d566c1498ca5
SHA256e73d395a56c8e0c084b59e5338631e214b4865b5ced5fc9454b80688280d2239
SHA51273833875de5576d7926b91b7826e6b1939c1dd38a3051e34aa02d8e4a0da75150edd62b0fd8b569e571337f145ac8be0c0f18a8c342c80fa355259e178c7b9d2
-
Filesize
324KB
MD542b6ce8bb3ad66d7f3e0863d22608c35
SHA19deee3167fa2f489318f531319992b2be354f164
SHA256c32e10b9ef6de348421b6842bfce8991557f8d2e3cd2c09a0c1012e731cadbea
SHA51275bfedc8e5b6ec769900fff64b0a0453d8b9a23ba851bb2c1dda0a0c84d78d63b1b8d6fbb42f7ca3a84b604952e58ca4767bb28e3d6d98566894cb920d6bb8c7