Overview

overview

9

Static

static

1

wave.exe

windows7-x64

7

wave.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    wave.exe

  • Size

    27.0MB

  • Sample

    240806-w99ebazgne

  • MD5

    8938e437b63b2e2b3e91825958567f2b

  • SHA1

    9b521cf6f1b53b7b95927cffc313ac09cf4606b6

  • SHA256

    0bcacfe5a5a36dca29e8d1abbde1c3858e1386cc72656228b46c32374f30966d

  • SHA512

    87c93555f3467bcf25cf2a386595ac95c3e49ac22cb490b6bf732d2b228a11238283bdd71036294e88e92c55f0ef4d7797d463dd6777dd1a547ace00bcc3982b

  • SSDEEP

    786432:0otq8vlkbrRQ9oFWUmESWqELGmiT4wJNXeRGF:0oY8v42WFW4qCi8+NuRGF

Score
9/10
credential_accessdiscoverypersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      wave.exe

    • Size

      27.0MB

    • MD5

      8938e437b63b2e2b3e91825958567f2b

    • SHA1

      9b521cf6f1b53b7b95927cffc313ac09cf4606b6

    • SHA256

      0bcacfe5a5a36dca29e8d1abbde1c3858e1386cc72656228b46c32374f30966d

    • SHA512

      87c93555f3467bcf25cf2a386595ac95c3e49ac22cb490b6bf732d2b228a11238283bdd71036294e88e92c55f0ef4d7797d463dd6777dd1a547ace00bcc3982b

    • SSDEEP

      786432:0otq8vlkbrRQ9oFWUmESWqELGmiT4wJNXeRGF:0oY8v42WFW4qCi8+NuRGF

    Score
    9/10
    discoveryupxcredential_accesspersistenceprivilege_escalationspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks