exelastealer | 4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974

Resubmissions

13-08-2024 23:36

240813-3lyfgawdrr 5

13-08-2024 23:33

240813-3jvxka1fkh 10

Sharing

Copy URL

Twitter E-mail

General

Target

byfron-01a570a3cd0a46f2.zip
Size

23.6MB
Sample

240813-3jvxka1fkh
MD5

f37e9fe25f88bee86e868c8796ba7624
SHA1

b8b0f2969f70ac8656ca082cb4206fd1eb83ee9e
SHA256

4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974
SHA512

6b0238be58859276c1f3ad99e5b38642b0c5d92b4b86f6010c10590c568b5bc0b0559a8524993e587844d8f3652dbfdbf841039cc2f781905250b5d65acab5fe
SSDEEP

393216:MZwPobA50pfTb7dQyftimFEH9ALcVxq1+TtIiFg0VQxh6uUlI6uUlT:MZwPoXpfP7Gmtim62aq1QtI6yCICT

Score

10^/10

Malware Config

Targets

- Target
  
  byfron-01a570a3cd0a46f2.zip
- Size
  
  23.6MB
- MD5
  
  f37e9fe25f88bee86e868c8796ba7624
- SHA1
  
  b8b0f2969f70ac8656ca082cb4206fd1eb83ee9e
- SHA256
  
  4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974
- SHA512
  
  6b0238be58859276c1f3ad99e5b38642b0c5d92b4b86f6010c10590c568b5bc0b0559a8524993e587844d8f3652dbfdbf841039cc2f781905250b5d65acab5fe
- SSDEEP
  
  393216:MZwPobA50pfTb7dQyftimFEH9ALcVxq1+TtIiFg0VQxh6uUlI6uUlT:MZwPoXpfP7Gmtim62aq1QtI6yCICT
Score

1^/10
behavioral1
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/Analysis-00.toc
- Size
  
  37KB
- MD5
  
  bea1b70393eb8841cacbc1fbcd3d6375
- SHA1
  
  c0cb304adea5a57662979598ff00c72523605e13
- SHA256
  
  0e23790d17949704d3788e8ec132dcd0bc4d135452d2833e490970ffc798c516
- SHA512
  
  7a81cf014b8ccf7cc1b87f64fcab1a94cce9f50bbb16bd14da03c8565cd67a0fb4fe5c5f8432e71bc45a34f5af0abf068f3bb1ddfc08a832a97405f09c12acc7
- SSDEEP
  
  192:zd28T8Z8KfrKMXyUD4BfpNRZXwN6fEg/I/oqo7EmWf0XSEP3c5aZbtKXmhLPn9uF:yZ2WIj9Uz6+jz3t5jc/anFG9M7h4v1S
Score

3^/10
behavioral2
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/Celestial.pkg
- Size
  
  9.2MB
- MD5
  
  f45c5462eb6c0eb3754045600ef6857b
- SHA1
  
  5f9fe9279cec84bbf8500f43d9b9d1ae683ac835
- SHA256
  
  967b762feabc65da844f7a173a1a7a597cdf935d20fe72939d5a63a5cc4b958a
- SHA512
  
  f90b954238240ed09d9ce91e35207d04d11f87098d7ce8b0fa7cef1d521ffea9a1d1e8a840c1bc25c777409d3edb75d3b9eac13577ba87b8cf0b5ea3ca8f291a
- SSDEEP
  
  196608:4Cc+wuLIRBA1HeT39IigwE1ncKOVVtc97rttQ1N+upx746:9cVxq1+TtIiFg0VQxh6uUl
Score

3^/10
behavioral3
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/EXE-00.toc
- Size
  
  6KB
- MD5
  
  c8986208f5866eddbe53691df886e50e
- SHA1
  
  5b30a30c5446dc6f2a1496f09fb8bd771ea72c82
- SHA256
  
  e361db1ba79c15af703b9756676d55c0821b46e389207887a4c69e48856b99d2
- SHA512
  
  ef095d96ed332cec3557d053c6457332a222fa682548de8bc3c3a6cae218fb72cfff15693e23c471abfeb0b15bdd291e10e9ed8f874159740cca390a726d0af8
- SSDEEP
  
  192:G8/rhs8O8T8Z8G8b6xGd1POh5v4Fo1RKNfuoTSFtH8+5v:x61d
Score

3^/10
behavioral4
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/PKG-00.toc
- Size
  
  5KB
- MD5
  
  5ca76f3d4fe96c8ff655e9a9e9a69fa1
- SHA1
  
  b938a5ae0319135b1ad57c90cd3fbdcaad20b75c
- SHA256
  
  91130c058434d88dce2e23a25da3aaf0b4b3ee1dfa7a60899c9b94058ce27a83
- SHA512
  
  944732d7de43eab685a6c215e7308cc578679d47d3fa2f4e29cf140af1f71244e1e72dbeaaedc6bad020048f48da7c3285d020d241f1ab4084ce5d40999023c8
- SSDEEP
  
  96:ZEQns8nO8T8Z85Y8b6P51wd1POK+5v6PfcPkffcf91RKNJhuoTSFt9:ps8O8T8Z8G8b6xGd1POh5v4Fo1RKNfuP
Score

3^/10
behavioral5
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/PYZ-00.pyz
- Size
  
  2.2MB
- MD5
  
  236b2e1958c9ffc232418dac2f94f58b
- SHA1
  
  e6079906f8632c5dec51ab79960f0095ef3d1505
- SHA256
  
  ba1c07fec047b0b8cb96b3cb44d12a01e2596b6ef90498258a8bdddbea543b73
- SHA512
  
  c1d8644ad925eaa45f37d715457fb35277a55dd102806af23dcbe432488c93f0a63f6cb339342c007910d15456f23c3e203ae882283dee11219d14777a83a24d
- SSDEEP
  
  49152:kISgbMltr8NatQYQMk92z0NdzF+AEbl3IhBPIH3VF8hNzl4Uv05wqzOX9M:kdRltrZtQX00jR+Ai2hBMM3Bv0m4W9M
Score

3^/10
behavioral6
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/PYZ-00.toc
- Size
  
  33KB
- MD5
  
  d0f60098f028f37884339ad0d6e70cea
- SHA1
  
  9bb4df4592575055a965e69acd21f9f46c837ac5
- SHA256
  
  ea7180e38f791a9960c2590064168bf5f56e47327634b39ab14e1ef4a74307f1
- SHA512
  
  6daaea1addec51d9260b39d1860f0bf2ae47278555a9a929a652b6bd0638aab34b08e62413c7f515127dd87eca940aec5a93911b1834378b099392aa537a094b
- SSDEEP
  
  192:gIqIPX5w8299Si+JLd5CQJm7trPhjvQkQSNhNMNqN+8HNl0Z7/ARcrCEI4QubqDs:RcaUT6cRfmIk2H58S1Iran49uV7hI
Score

3^/10
behavioral7
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/base_library.zip
- Size
  
  1.3MB
- MD5
  
  43935f81d0c08e8ab1dfe88d65af86d8
- SHA1
  
  abb6eae98264ee4209b81996c956a010ecf9159b
- SHA256
  
  c611943f0aeb3292d049437cb03500cc2f8d12f23faf55e644bca82f43679bc0
- SHA512
  
  06a9dcd310aa538664b08f817ec1c6cfa3f748810d76559c46878ea90796804904d41ac79535c7f63114df34c0e5de6d0452bb30df54b77118d925f21cfa1955
- SSDEEP
  
  12288:NttcY+bS4OmE1jc+fYNXPh26UZWAzDX7jOIqL3QtltIrdmoPFHz1dc+4/BaYcUz:NttcY+NHSPD/eMKrdmoPxzFcaYcUz
Score

1^/10
behavioral8
- Target
  
  _collections_abc.pyc
- Size
  
  45KB
- MD5
  
  029620a27312738e30760b1210856b47
- SHA1
  
  e40b473edd7056f59983fd80011ffcdbaf397158
- SHA256
  
  3101d29025ff582197fa8ba766601d7d5fdd032e83956dcfa482dd8bd85e6e99
- SHA512
  
  3c3c01d22fcdd45ca3214d6afbd6f82868a931701c3897bc5b6bc0e0d8d894538ae194af209a1a93dcc9eacfad537085c27b85d9c1c751d6bff91efbbcc694b7
- SSDEEP
  
  768:3Rvah051+LblmqZtsYCiW2ke3imX9wtcY+Yz204kwq7aGjY:Vah051+LE4OxiWxe3imX9wtcY+Yz2045
Score

3^/10
behavioral9
- Target
  
  _weakrefset.pyc
- Size
  
  11KB
- MD5
  
  6e34f39ade20dec78f4c2128ca3aa2f2
- SHA1
  
  cb02f29d6fcef6e6b701bd6b771bad941f06e0a5
- SHA256
  
  8da0cc7e8766f257163bd409c542a12524a8f4331659f958d723f5a3fff8f5cc
- SHA512
  
  9b5949de7b630d19f672f4f1c904ccedc439181c185b4b3352b96bdd19bf3ccd83c5c64d4b073d5f7177922c91dae8f6f241aa4d6e7a3c6dd91e04d71d5f0e5a
- SSDEEP
  
  192:D088gw/TnrErQdX9qnPHpAJ6FLQnE6mr1R23vJJ1BXWo:DpvknrLNqPHp8nE6q1YJ3Wo
Score

3^/10
behavioral10
- Target
  
  codecs.pyc
- Size
  
  41KB
- MD5
  
  9d3d63c6e6a51d79193cba2cda7063d7
- SHA1
  
  ca2b8aba7bf853b6fb525f6539be28a796be5e9c
- SHA256
  
  ef476af26f2079cc567d126e6de8fd01a828751f5e19084ca264e26b17f67f87
- SHA512
  
  2c7956f0dfc87568dd41316e9b0f874bec155eadd21a32e2804e2f8532e6d7229f19ccfb1250dcf5350098310d999a387ccc9d25adce6f0745ddb9f7c69b626a
- SSDEEP
  
  768:CRAoQwegBo00pgcQZ6VYQg0Ewwx3nxrPLCG8zYO8iZBqT1UtS9A0a8P:CgnRqxwwJx38zWiZBqJUtS9A0RP
Score

3^/10
behavioral11
- Target
  
  collections/__init__.pyc
- Size
  
  71KB
- MD5
  
  068d9f9afcc24f2e048b33756b1a166c
- SHA1
  
  288c3ba53224951f1c6b23b0c6b0ffd17b1de145
- SHA256
  
  283d18b412ff5b7e11d3c07df018cc884563d70783872bbf5d5da90e836fe45a
- SHA512
  
  f8761ec610dfca0e0633f5995cd63e0b6265165548727c6b3ba896ffdeeda9267aac033bde17c8c8410ab5602a7824ccf87ce39e396f6786af66185dc67aabab
- SSDEEP
  
  1536:yUYx/OmRbTHnbDRBPoYI9hzbY0ANk6NZQJhwdLX/AKazOklQdIGKe+i:xOOm1TQh60OkOfMi
Score

3^/10
behavioral12
- Target
  
  collections/abc.pyc
- Size
  
  229B
- MD5
  
  d1c51b86218a81d592489ec4ff5d7b5f
- SHA1
  
  fa89555bfb79da4990bc4af3d0eea5e80bb2aaf8
- SHA256
  
  e25276e703d0c9f6bfc5a6e1fab9c04751d8072e563882ec459b296947aad9a1
- SHA512
  
  e7aad479a823712998b8cac91c3d825e7dc03f98486d861485b6ad9edbc045addb2624933589545d0e03bc3342e1c09e7c8db5fe47a5dee7f3980e1ef56a544b
Score

3^/10
behavioral13
- Target
  
  copyreg.pyc
- Size
  
  7KB
- MD5
  
  7b72d5b46ea970b4d12986837ee36719
- SHA1
  
  e4ecee17d53f6f2eff8f377921e873c9e6bac347
- SHA256
  
  85b19606c08e51a7ad3d47c0efc4bf629dfbac2033e13010b62546bddaaa74f4
- SHA512
  
  505fa0320c3bdf68f057b8aee5d896e7212a10011b8fc67f706fed377eb5a2876096548bb8ee2da9db7f69b2692c138cce1af5aee8fe628f48efe81af0c78ce5
- SSDEEP
  
  192:nHfFIq6AmDm5cx4LbrCGHfhAAHEHj8TI1IH7TbPcN:n/v6Am8cA/PsjJGjcN
Score

3^/10
behavioral14
- Target
  
  encodings/__init__.pyc
- Size
  
  5KB
- MD5
  
  30ebe04e4a4c23751231cf1bd997d1ce
- SHA1
  
  52a1620179753e41d02e6e7c7ca6104ab99647cf
- SHA256
  
  58d0b80bda8252ffc979d6b2f95743968f9cdbac3abb2215ef04470ab2709171
- SHA512
  
  43c24eb4fb7e786b7a5f4743574dfdb95fa98e0646a01abe249df8d7344e4253df64f685f55b5337100269edae4d58b51a9c14e7a6f9d08156215807fff3c72e
- SSDEEP
  
  96:MvoHIYGspF3e06Q0YXxYBYH/6kVXfM1fKYnjkwVY5tTbxal02Vf8Xi/KSZ2Dh2xY:MYLpFkYXCBGXiKYnjkwaD500e/ko2lUG
Score

3^/10
behavioral15
- Target
  
  encodings/aliases.pyc
- Size
  
  12KB
- MD5
  
  8d2af8194533d706c256fef64827f932
- SHA1
  
  f27e36b074a303b5f776b42a0b979412b075438b
- SHA256
  
  96c505db5024b3c1f4313ad2ce9f2e3f0b8755c62587a893f23c0dadea66ab09
- SHA512
  
  c06f96f25af5537adef5fb530c63aea994410fc4d55fa9431982f677a39349b48cb86e7920d0c9cf6a0536e92190fe5b3b7b1a1abc9746f7870407293905b396
- SSDEEP
  
  192:XX2eNkBweGfGkueKm+I14Xqb36RhOgaxL8PZm+/Qnu1i4WH2lEfBN2ckAaq1Ya1A:XXG0buenU6uHc+T7Ofj2fUYxCwZuiBF
Score

3^/10
behavioral16
- Target
  
  encodings/ascii.pyc
- Size
  
  2KB
- MD5
  
  c10bea4c9085bea6fc6f091900c6ff9f
- SHA1
  
  9ae606053c25e2102d428c1f59adb23d9abbfe0a
- SHA256
  
  fc045fbc7d7e067683c8532fe6623d86832a42805d225f32653e334ab01b0613
- SHA512
  
  25dc6a04781b8788f2f67a27babbb1f8670f1eb6791db3c91f482ddc8f0feb1f24579bb0e3c7f22edced7ae730675bc22ad99461c66765ab8475c9cbd163c652
Score

3^/10
behavioral17
- Target
  
  encodings/base64_codec.pyc
- Size
  
  2KB
- MD5
  
  8eb2ada7766bd83701a241e568c48008
- SHA1
  
  8b5b4ae98abcee611dacec039328eeb8a90eccb6
- SHA256
  
  8bc9f8041937b9758aeb2160a5401c60d93cc46cc0707d3946915c0a76cd2cb6
- SHA512
  
  c0afa9eae9480e741a27649ebd9a101d2cccba206938b0d5daa7b7e7237905c7d0054018bb0a7aa542dd602012ad01b8b0cfb33f83bdad316f5b7a3d727325aa
Score

3^/10
behavioral18
- Target
  
  encodings/big5.pyc
- Size
  
  1KB
- MD5
  
  802f4f7671defde243f704ac8343abec
- SHA1
  
  77ca0e773cd23137fe037a0ade50645f97e154ac
- SHA256
  
  e66fbec313ca10fe08dd762cab70006dfaa3825df5a4120d8eade265443739f3
- SHA512
  
  03d52d277318cadcd8836262459aaf65e0802d08d910b912a3de09be200795ccbdc279f413a0cbdfc03d7b22518e5e74cfcdda7325c9bca13dabf6fc4bcf89fa
Score

3^/10
behavioral19
- Target
  
  encodings/big5hkscs.pyc
- Size
  
  1KB
- MD5
  
  2d06d6598acf2400c94728d5a3669ba4
- SHA1
  
  3fb5e60ba99a4f5f7d5ceb98b4afc088a475302c
- SHA256
  
  3576f7607c4223e4d63782421cc7d0800c28ddd8f2cacae2ee297a52200659e1
- SHA512
  
  ddb70940d1c4435cf296f7de00fd26225f3674ea0597fe400dd92bb4fa854745a726415a4d535b2aba7ec866082450293e5de0abd4a2b6fa8d19f0d5f08daa3e
Score

3^/10
behavioral20
- Target
  
  encodings/bz2_codec.pyc
- Size
  
  4KB
- MD5
  
  30d8b4e1cc3bfce6de5a7bbe11143726
- SHA1
  
  2d5428380786c40efd6a9d7d90e79f57522ac0f3
- SHA256
  
  d97f5c0d62000d4a19f68a0db35b39292dcbbfc799e4353b115f8465527914cf
- SHA512
  
  8b948bc736faa51e22580f7fc6d7dfc145768871466f88a0dc6a3eb85f9347d605e42f1ce1a206a64c0e05a3e277e9f138da01108dd6bab930bc8c6f03cd090d
- SSDEEP
  
  96:obDAXtUGW5bfx42wPVoKCE2hpYblvjk7G2gmZ:obEXtU3b542+qKCphWlvwG2dZ
Score

3^/10
behavioral21
- Target
  
  encodings/charmap.pyc
- Size
  
  3KB
- MD5
  
  778ded87c12b5817aa39e47501e2ad15
- SHA1
  
  65c2f9f3244c06559eedc49d9c68fcbf488693c7
- SHA256
  
  dd18974947edd81cba2dc0491ea991e215b8e17ff41d83c75e4717770785f99c
- SHA512
  
  13b596cd691228344153f7bd1ed5bd1900733ff162fe891f662b39495bbef9b83d919c3316f164c3a30ac138c1a620609f6b1c534e77c3edd81f61b0dc023eab
Score

3^/10
behavioral22
- Target
  
  encodings/cp037.pyc
- Size
  
  3KB
- MD5
  
  3093e2ff2507818c4ba0af86759a1f5f
- SHA1
  
  d4d8b9838e7c7d2189c1efb51ca41e8f52e89897
- SHA256
  
  a5b1f487f242f9997b02d18a12466d3d4eafec4e96663453f198093083b7bd61
- SHA512
  
  a899433091d6aa8bb65dbb3c279d815b28a3c14655a686c1f8fa521dedcae8bc2021d5130143c8dacf17485caa94e3241a004839e62b553963b90379d596ceb4
Score

3^/10
behavioral23
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod01_archive.pyc
- Size
  
  5KB
- MD5
  
  34922b88193ce6b0232599077e82c0e1
- SHA1
  
  2ddde5b4ac6c0caafc54f972d54cfdd45eed05a0
- SHA256
  
  b22e8dfdc1a5dfd41e41c420d228d7ea681a9224e3dc8fb2426238d2591ff06d
- SHA512
  
  dbb6f503627fed296449dba94d44ca83bb55621fecad8b9b0feab258d9258d599162bd2b8e645b4a40d49f49c65711fb485768e5d83acb5a2cc71353e2533b16
- SSDEEP
  
  96:mAA10L+KCgwXZTKlNUFjHKPN65H/Y3jZpof3732zYn16ec7xyn:ZqodoAUF7CgQ3jvo/S0m9yn
Score

3^/10
behavioral24
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod02_importers.pyc
- Size
  
  23KB
- MD5
  
  0e643b06b81c5f0a0970646dce56b5e2
- SHA1
  
  997bf56a106cac4cc96df6a6648ab738a7d46e07
- SHA256
  
  2589cff595f96fdf284d38115a1ffefd9d69df3c28bf7b8c75c5306a3de160e0
- SHA512
  
  a2038eb6b0714e3b4d0291151d47d552123c4228d5eeecb2f114a6bf52c7f94bd542b9a4f49437371636a3633ff08831bc2f0edeba4c8d0f80dfc6f95bd39263
- SSDEEP
  
  384:Unbo7Lr04Vp/Win2M5ngPMAUggNQvsA/3c6JlQ55QyFmZ:Unb2Lr0kp+in3bABGxA/sUlQ52yMZ
Score

3^/10
behavioral25
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod03_ctypes.pyc
- Size
  
  6KB
- MD5
  
  f1296ab0e8ab54acfef7db2d0b1fda2c
- SHA1
  
  c05baf56f3eca9e55f539b82788bdd0cee950017
- SHA256
  
  b8925da6cda6e8a2622580cda0329f3cbd2db57fe1c7880d545201a049073771
- SHA512
  
  2944afabb5ca13930ebf23a8d6fa208caa6e515dd103318fdf2db9cc896f1bc1720076a3dd8ef02b5312f59815c0c38794e144b229c2937a31492e4b999f49ee
- SSDEEP
  
  192:mGMc7cBkYCsHYbyLYbufYbg00HiDaP7CmMdI:nB+kFsHAyLAufAg96aDChdI
Score

3^/10
behavioral26
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod04_pywin32.pyc
- Size
  
  1KB
- MD5
  
  02bbbc8376390cd37cd9770f3b04b000
- SHA1
  
  e4b92dcd532d80dfac77498c978cf5ec6f860ac6
- SHA256
  
  079c683ad728af76bb13dc998bd095956437103855e77eb61b87d006ff6c44ba
- SHA512
  
  614badd860b20cb4cafe33d0417d754d848ceaace203a72d7ebbea6586bac220e7ccf1cbc99eb0855876479deb26a852d20ccf69e512ff818882561f16d725bc
Score

3^/10
behavioral27
- Target
  
  byfron-01a570a3cd0a46f2/Celestial/localpycs/struct.pyc
- Size
  
  305B
- MD5
  
  fb4d1be9dd47ca318366df9537c96c49
- SHA1
  
  d63627de3c9879aa4ea0eb13358b069a68e96fff
- SHA256
  
  eda2f45c238b798e1ca78ebce2b4b6c44776e0f2e41575ffe3c3f72b8f01c3bd
- SHA512
  
  37e3c0a3be228531bab588535d96c46e98cc6ff0a1ce2fe8646cd5e8ae9ac76096ab3db654ee5796a9284373fc9b297d5e19ff5fccf06e0b5c6d0ced5e67d279
Score

3^/10
behavioral28
- Target
  
  byfron-01a570a3cd0a46f2/CelestialLLC.exe
- Size
  
  9.9MB
- MD5
  
  e843d7c548b7eaba01ba8f87a43a2e30
- SHA1
  
  0fb8b728df9df103535fd4af8cf7d500663dfab5
- SHA256
  
  ede88bc40a5dc4bec686ef712472f8a63c174691d920eec08fb9dd9a5c040ef9
- SHA512
  
  ec5a80ce5d72e0d3e19eb378ba0dc4663c76d00c1116c026129ce2b8566dfe3df51df9b0c6db9a793edf3d613b1843f11eafd6b3e85b783e1d9ac635812e6437
- SSDEEP
  
  196608:r4pUrJPhwPoMhmwJ50pFB7iIbZg4TVdQNm5XKCt7oRE1F3:rZwPobA50pfTb7dQyftimF
Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer
- Exela Stealer
  Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
  stealer exelastealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral29
- Target
  
  byfron-01a570a3cd0a46f2/driver.dll
- Size
  
  202KB
- MD5
  
  1fb58ae94d360c3983c3fe1d1252d86b
- SHA1
  
  146cd3a402192cecd18516423f6b42eb6a65dac2
- SHA256
  
  5212b88ba87abafd4bd25a55f06f1872f1a040b8924327c2ec00332b89d95bcb
- SHA512
  
  f8c74b5e3b36f8bf0e9ad37714c3d8d66ce18c0b9ef3a3aaa7c56a1925cb2edf85e831f6d9a65bf9248d5738f367ef4def0b6a443afb57c154af8df27b2cd050
- SSDEEP
  
  6144:3C8PgEaNIqydt8F59UL1DDZ9UAlatl4XSJ0vpC:3RPg5IqW8F02T0xC
Score

3^/10

discovery
behavioral30
- Target
  
  byfron-01a570a3cd0a46f2/mapper.dll
- Size
  
  756KB
- MD5
  
  ef3e115c225588a680acf365158b2f4a
- SHA1
  
  ecda6d3b4642d2451817833b39248778e9c2cbb0
- SHA256
  
  25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
- SHA512
  
  d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
- SSDEEP
  
  12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
Score

3^/10

discovery
behavioral31
- Target
  
  byfron-01a570a3cd0a46f2/version.txt
- Size
  
  54B
- MD5
  
  25d487c607c53f85cb299f861d1b1cbc
- SHA1
  
  f043af50b199aa2e94cadd9757c98d0b048bf65d
- SHA256
  
  6cb77165951d12a5aff2d0527675fc9554267f34c8a03ab1f4a04aefc62ae888
- SHA512
  
  17d26d85374fb1599bc57df1de7e40e395f26769b37116c5c3c2643edc293d6809ae6bd179fee6d00a190282f66711b7f0cf4acf50b00f3c433fcc541c13e4b2
Score

3^/10
behavioral32