General
- Target c27180127362921dffe5091bb7053e4e.bin
- Size 62.8MB
- Sample240806-ek1x7sshqd
- SHA256 b9b5a672b3d731ed09326c2e8622fadc122c1bec3d1acb11f4925456108fdb40
Malware Config
Targets
-
- Target ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea.exe
- Size 62.8MB
- SHA256 ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea
Score9/10Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 6.5MB
- SHA256 0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014
Score1/10 -
- Target libEGL.dll
- Size 468KB
- SHA256 d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577
Score1/10 -
- Target libGLESv2.dll
- Size 7.2MB
- SHA256 50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e
Score1/10 -
- Target main.exe
- Size 154.5MB
- SHA256 0f517c92d40094c99dafb7a82cd455dd139295157925a1d6ced55e4ecde08453
Score9/10Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Enumerates processes with tasklist
-
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.0MB
- SHA256 6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
Score1/10 -
- Target vulkan-1.dll
- Size 899KB
- SHA256 f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3