00cf81d3004efd89a47d5edb042969205342d90ea6c7b0f7bc1e4069865e73ff | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Starwolf_beta.exe
Size

68.3MB
Sample

240901-zglz4a1hkb
MD5

3ea1c457fe2bd92ffdcbd4b3b46ae0f8
SHA1

15a02ab314b69160e1573e96a582500d18426f7e
SHA256

00cf81d3004efd89a47d5edb042969205342d90ea6c7b0f7bc1e4069865e73ff
SHA512

403c91011968cedc41eec75c16294c0062238b11051cf9f2d461d5866ddea54c81cecf8685f6c59d1c86493e52b66e4d9a05cbde7f34cdda2fc3bd46f47d227c
SSDEEP

393216:PyT3YGojrsBEnP4XrqSFM+FcrONRtgZJ93AEMQu58EISEhoIaE2FShMzTVA+BDE0:PWeBZ6QxhUDE52O26rsxciz/WyW/ZyVH

Score

9^/10

credential_access discovery execution spyware stealer

Malware Config

Targets

- Target
  
  Starwolf_beta.exe
- Size
  
  68.3MB
- MD5
  
  3ea1c457fe2bd92ffdcbd4b3b46ae0f8
- SHA1
  
  15a02ab314b69160e1573e96a582500d18426f7e
- SHA256
  
  00cf81d3004efd89a47d5edb042969205342d90ea6c7b0f7bc1e4069865e73ff
- SHA512
  
  403c91011968cedc41eec75c16294c0062238b11051cf9f2d461d5866ddea54c81cecf8685f6c59d1c86493e52b66e4d9a05cbde7f34cdda2fc3bd46f47d227c
- SSDEEP
  
  393216:PyT3YGojrsBEnP4XrqSFM+FcrONRtgZJ93AEMQu58EISEhoIaE2FShMzTVA+BDE0:PWeBZ6QxhUDE52O26rsxciz/WyW/ZyVH
Score

9^/10

credential_access discovery execution spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

credential_accessdiscoveryexecutionspywarestealer