Resubmissions

12/10/2024, 16:14

241012-tpyqzaygmf 7

03/09/2024, 06:24

240903-g53nmszbqr 9

General

  • Target

    Stremio+4.4.168.exe

  • Size

    112.9MB

  • Sample

    240903-g53nmszbqr

  • MD5

    763b10b7a9293ccc9307b650a01db702

  • SHA1

    b033764307a4df6cc81c654467630f2df67297ef

  • SHA256

    44ecc6a7624b2fdf03cb9b419f111892515fb036fe23f88e51456dce69066046

  • SHA512

    f6f8d0a78cfaa2c440567fc0e636ab6129c495991f679c93ae0b7e211d9e290e7d4628891fef35f0383662bc2237e21410dd849f1d6074a8994dfd8deeee5e0c

  • SSDEEP

    3145728:XddpqKUfzM8/I/6Uj2jDxXz8sGd1TiDlSugSbc+cYOsNCO1JTN:tdoK18wiucDZxG7TOlS/SI+JNCO19N

Malware Config

Targets

    • Target

      Stremio+4.4.168.exe

    • Size

      112.9MB

    • MD5

      763b10b7a9293ccc9307b650a01db702

    • SHA1

      b033764307a4df6cc81c654467630f2df67297ef

    • SHA256

      44ecc6a7624b2fdf03cb9b419f111892515fb036fe23f88e51456dce69066046

    • SHA512

      f6f8d0a78cfaa2c440567fc0e636ab6129c495991f679c93ae0b7e211d9e290e7d4628891fef35f0383662bc2237e21410dd849f1d6074a8994dfd8deeee5e0c

    • SSDEEP

      3145728:XddpqKUfzM8/I/6Uj2jDxXz8sGd1TiDlSugSbc+cYOsNCO1JTN:tdoK18wiucDZxG7TOlS/SI+JNCO19N

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks