General
-
Target
Emma V6.exe
-
Size
1.6MB
-
Sample
240823-2w85aatfmk
-
MD5
aac115654fd637376a96b46794d8ab99
-
SHA1
5fa30297afe8d3502d807f510e80c7e62a2a9e88
-
SHA256
a8358fe9d6c84b8b06d69ca00b8236e2ad8fdf88f6d3f2e2386abf27a631c4ad
-
SHA512
9c5df76d2c01e8639e2e97f99c3418fd31762abebac34c3350442adcac50456e5d3592b847169cec1f6780b8ecbbb5e10841cb4f80a54d63b3b462e865f8ce67
-
SSDEEP
49152:OkTq24GjdGSiqkqXfd+/9AqYanieKdsG:O1EjdGSiqkqXf0FLYW
Behavioral task
behavioral1
Sample
Emma V6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Emma V6.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
stealerium
https://discord.com/api/webhooks/1276642384742055958/0YZ5JihKBfwTtzcx6Lgs0EI5SIICKZ3ztFdmF_91_lRqaZuP94tH8Uc7mr9L0txksi-l
Targets
-
-
Target
Emma V6.exe
-
Size
1.6MB
-
MD5
aac115654fd637376a96b46794d8ab99
-
SHA1
5fa30297afe8d3502d807f510e80c7e62a2a9e88
-
SHA256
a8358fe9d6c84b8b06d69ca00b8236e2ad8fdf88f6d3f2e2386abf27a631c4ad
-
SHA512
9c5df76d2c01e8639e2e97f99c3418fd31762abebac34c3350442adcac50456e5d3592b847169cec1f6780b8ecbbb5e10841cb4f80a54d63b3b462e865f8ce67
-
SSDEEP
49152:OkTq24GjdGSiqkqXfd+/9AqYanieKdsG:O1EjdGSiqkqXf0FLYW
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-