Overview

overview

10

Static

static

10

utopiaclie...nt.exe

windows7-x64

7

utopiaclie...nt.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    utopiaclient-main.zip

  • Size

    18.7MB

  • Sample

    240815-fts5ds1ejn

  • MD5

    82bb2f5378d4faec462c3ef5bd531548

  • SHA1

    80287a1a17eb4d1e3658e309e767e83d33c9b36f

  • SHA256

    fbfa276166fdb9cacadbc96ac83aefa8a6d2a170e47d9fe5bb66a8345b76e316

  • SHA512

    d14b80677f6c218dec61ab3743a5a98923082a3e84bd82124c11c642953e22e257d42f7d41449d70e78ca290e07564944736f5b1f900adf06126c4ae162a9aed

  • SSDEEP

    393216:+DofJHb9LhFXufGdzncep+CvvYQ+mYTdNqEwFiRFF+BEFeH:vfBb99FXufGiUcjmGFsnH

Score
10/10
empyreancredential_accessdiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      utopiaclient-main/utopiaclient.exe

    • Size

      18.9MB

    • MD5

      03472cdaccde61c4c0f24762ed3e4fbe

    • SHA1

      bbed6a2d3c94d7343813154e9e9426d584b330b9

    • SHA256

      ede680265619987f27b3a8a9da36c79546d45e440045d9a5fd89fb85ee74eef4

    • SHA512

      731d2e5823dfaf10a1cc348c5e1b55299c9d07198545eb19370d2d195042e96c2e8565e1e75c07574aef9bd7279b7ca81a776916ed2a3c1b9d4b0d83347ad778

    • SSDEEP

      393216:vqPnLFXlrFrQ8DOETgsvfGF9gru1fvE4VRfjPG7yPm:CPLFXNFrQhEIUB6frG5

    Score
    9/10
    upxcredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks