General
-
Target
03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272.exe
-
Size
14.2MB
-
Sample
240904-bda7estajc
-
MD5
59a08bb8bf4881e814fd3d36f525da8a
-
SHA1
3f542be6b20daef732a4c4bee9bad1dde8b375f0
-
SHA256
03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272
-
SHA512
dfc2c2a0c743918642943d296c3b26367d80ce49d3c0ee099c27398ed134a965203014b1b0346e41d882531f8d0bdb878cc38ee1c2420844bd9cfd70677e002a
-
SSDEEP
196608:oWJafoL/tUoTX4Z8bh1Yf0k7Ma/rkFlgdTaUrPPbdfw:oWsfm/Vbh1lkSFCdTauZo
Behavioral task
behavioral1
Sample
03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
skuld
https://ptb.discord.com/api/webhooks/1277694857338687561/FxXidvF_Xcdm1mFBnfMwjGWhByymrClV-px0CZhfTr9YtQWuA8etVIU6_PpLcbsJWD9d
Targets
-
-
Target
03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272.exe
-
Size
14.2MB
-
MD5
59a08bb8bf4881e814fd3d36f525da8a
-
SHA1
3f542be6b20daef732a4c4bee9bad1dde8b375f0
-
SHA256
03da816f34074a5e1941ababc4cbab2880d149a03b1b3b1000cf065479d50272
-
SHA512
dfc2c2a0c743918642943d296c3b26367d80ce49d3c0ee099c27398ed134a965203014b1b0346e41d882531f8d0bdb878cc38ee1c2420844bd9cfd70677e002a
-
SSDEEP
196608:oWJafoL/tUoTX4Z8bh1Yf0k7Ma/rkFlgdTaUrPPbdfw:oWsfm/Vbh1lkSFCdTauZo
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Drops file in Drivers directory
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4