Overview

overview

9

Static

static

3

install.exe

windows7-x64

7

install.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    install.exe

  • Size

    14.8MB

  • Sample

    240814-plwpzswhlj

  • MD5

    305be8d804fc8df2ba57d32d1aca4d49

  • SHA1

    66825016c1e0170307bd2640801b443c20de1c8d

  • SHA256

    b7857be3a3c3c7cf2218aa729828e1e39184ce9aea9b6ebb4bc93ba4f5d8edb7

  • SHA512

    80e9db8cddb6c0913df5fae78363132bb8effad6d3e5f5a65539d41b0804280d759a8c53afc54de10f2b50c7162f7ac96e329fea801d45b5d5506369ac32ec7b

  • SSDEEP

    393216:PlCQgf8uZxlHOFS1+TtIiFGuvB5IjWqn6eCz1o7nyX8Wjs8:PJbuB/1QtIZS3ILn6e37ntes8

Score
9/10
credential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      install.exe

    • Size

      14.8MB

    • MD5

      305be8d804fc8df2ba57d32d1aca4d49

    • SHA1

      66825016c1e0170307bd2640801b443c20de1c8d

    • SHA256

      b7857be3a3c3c7cf2218aa729828e1e39184ce9aea9b6ebb4bc93ba4f5d8edb7

    • SHA512

      80e9db8cddb6c0913df5fae78363132bb8effad6d3e5f5a65539d41b0804280d759a8c53afc54de10f2b50c7162f7ac96e329fea801d45b5d5506369ac32ec7b

    • SSDEEP

      393216:PlCQgf8uZxlHOFS1+TtIiFGuvB5IjWqn6eCz1o7nyX8Wjs8:PJbuB/1QtIZS3ILn6e37ntes8

    Score
    9/10
    credential_accessdiscoveryspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks