b0ebec322ce578522d3187e902c962968e9af4805f0d3eefae549f99a9c7d391

Resubmissions

27/10/2026, 16:58

261027-vg4spavzcs7

07/08/2024, 00:42

240807-a2df1syhnc9

07/08/2024, 00:38

240807-azf45avhrn9

07/08/2024, 00:35

240807-axsedavhmk7

Sharing

Copy URL Twitter E-mail

General

Target
Tone2_KeyGen.exe
Size 541KB
Sample240807-a2df1syhnc
SHA256 b0ebec322ce578522d3187e902c962968e9af4805f0d3eefae549f99a9c7d391
MD5 23b8db6e59d1b5742d662c2e9aadf960
SHA1 c23959e602c0c5091a869d58f0e559e57482e233
SHA512 a9ef60ed4393b410b665454371918aeb5f66d82a9444a301668e03c9d093ae29876d89e0818473c2e157ec6d61f8183c7b72f57f853e5de1896735ad15fc746e
SSDEEP 12288:XYkc9t2Sll/T/ohkU3xg63nsGDxIVhxdKxoSZvj:XYkcL5T/50nSxor
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  Tone2_KeyGen.exe
- Size 541KB
- SHA256 b0ebec322ce578522d3187e902c962968e9af4805f0d3eefae549f99a9c7d391
- MD5 23b8db6e59d1b5742d662c2e9aadf960
- SHA1 c23959e602c0c5091a869d58f0e559e57482e233
- SHA512 a9ef60ed4393b410b665454371918aeb5f66d82a9444a301668e03c9d093ae29876d89e0818473c2e157ec6d61f8183c7b72f57f853e5de1896735ad15fc746e
- SSDEEP 12288:XYkc9t2Sll/T/ohkU3xg63nsGDxIVhxdKxoSZvj:XYkcL5T/50nSxor
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

credential_access discovery stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral1
- Target
  $TEMP/keygen.exe
- Size 492KB
- SHA256 a2204caa5d2f178a68ab0a803af9df1145c19ee66dccc72282e048482dbff7fa
- MD5 15f2d430bc32b3e4d95f2d915f9f7d83
- SHA1 f60f5a8f968f1b36d689aabeaff62d43f205d614
- SHA512 42dfebe4ea7016e862681db2f4231846dabe5c891eaa604ef1e32606c6014a9b7f14b5adb816b6283c85e0a26d3ec06be74c9110a27e5ff8b6f1a9826c57dfc4
- SSDEEP 6144:pcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOoEFz3pf47oZHGFnRQNCg5Z3E1TUA:pc/kEPDonR6Y436vRLFnCktEdUQd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Credentials from Password Stores: Credentials from Web Browsers

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2