Overview

overview

10

Static

static

3

WaveKeyGen.7z

windows11-21h2-x64

10

WaveKeyGen.sln

windows11-21h2-x64

3

WaveKeyGen/Program.js

windows11-21h2-x64

3

WaveKeyGen...csproj

windows11-21h2-x64

3

WaveKeyGen...tes.cs

windows11-21h2-x64

1

WaveKeyGen...nfo.cs

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen...config

windows11-21h2-x64

3

WaveKeyGen...s.g.cs

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen...te.txt

windows11-21h2-x64

3

WaveKeyGen...en.exe

windows11-21h2-x64

1

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen...en.pdb

windows11-21h2-x64

3

WaveKeyGen...st.exe

windows11-21h2-x64

1

WaveKeyGen...en.exe

windows11-21h2-x64

1

WaveKeyGen...en.exe

windows11-21h2-x64

1

WaveKeyGen...tes.cs

windows11-21h2-x64

1

WaveKeyGen...nfo.cs

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen...config

windows11-21h2-x64

3

WaveKeyGen...s.g.cs

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen....cache

windows11-21h2-x64

3

WaveKeyGen...en.exe

windows11-21h2-x64

1

WaveKeyGen...st.exe

windows11-21h2-x64

1

WaveKeyGen...en.exe

windows11-21h2-x64

1

WaveKeyGen...en.exe

windows11-21h2-x64

1

WaveKeyGen...ler.js

windows11-21h2-x64

3

WaveKeyGen...ger.js

windows11-21h2-x64

3

Resubmissions

30-10-2024 15:47

241030-s78hfswhrk 3

23-10-2024 15:27

241023-sv3rfaxcnd 3

23-10-2024 15:23

241023-ssksvaxbld 3

04-09-2024 13:53

240904-q65ztssflb 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WaveKeyGen.zip

  • Size

    97KB

  • Sample

    240904-q65ztssflb

  • MD5

    f72d01d4573ba1ca18202804587692e0

  • SHA1

    64dd3ed6d4e6f5abb73dcd1772b54d09857815a2

  • SHA256

    8a2e5e073d34f4fb7cda2040d30e23d60cb675b71120e0e2c39838015c66f306

  • SHA512

    f7047a582bb826306eb01dc58c276b115ce2d685f28b5fd44c643441367f520735784445f957eaba65961bc91a64c16d65ecd3a764814b119cf73d88688b2f02

  • SSDEEP

    3072:3N1azrCbYA0XHdtusSlyJRzO+KT9yN4wUdrIoR:fWHXHdtI63KZ84Bpn

Score
10/10
exelastealercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      WaveKeyGen.zip

    • Size

      97KB

    • MD5

      f72d01d4573ba1ca18202804587692e0

    • SHA1

      64dd3ed6d4e6f5abb73dcd1772b54d09857815a2

    • SHA256

      8a2e5e073d34f4fb7cda2040d30e23d60cb675b71120e0e2c39838015c66f306

    • SHA512

      f7047a582bb826306eb01dc58c276b115ce2d685f28b5fd44c643441367f520735784445f957eaba65961bc91a64c16d65ecd3a764814b119cf73d88688b2f02

    • SSDEEP

      3072:3N1azrCbYA0XHdtusSlyJRzO+KT9yN4wUdrIoR:fWHXHdtI63KZ84Bpn

    Score
    10/10
    exelastealercollectioncredential_accessdefense_evasiondiscoveryevasionpersistenceprivilege_escalationpyinstallerspywarestealerupx

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1

    • Target

      WaveKeyGen.sln

    • Size

      801B

    • MD5

      952b2225e24c6a88e54d2fe69d8f9e7d

    • SHA1

      58469faff016934ea61f3c2c70fb3d2f43845066

    • SHA256

      e2f781c54d6bcd6cd11673b1b76f91788c4907be5fd22a79c1749fc2bf02bbaf

    • SHA512

      fe9268a0fb96af9676046749a990c6b0afe0c527c91df7e016693af8fd8d6328f0fa07aa8b857795ad0eb4d2639debeaf2df5094ac8bbf0dc9901070a1cf5192

    Score
    3/10
    behavioral2

    • Target

      WaveKeyGen/Program.cs

    • Size

      4KB

    • MD5

      9f8849a20b5b1b7afad7f47724a1f603

    • SHA1

      6cddede3a0dc3201560e0010c652f6f002877eeb

    • SHA256

      1cff861221d220880e2d28bc8f9a1f521b2e8d3b44b17b48742366d1a80bbe42

    • SHA512

      c6e9d54a6b0744afb34ace7866c1c734bcc01fad2784f08b00d47f7fb867bf2f99802808ca3fe5ac972b867e47ff92c12db345f31b38ea121976c641681e86d3

    • SSDEEP

      48:J+e4XTXvi0+x0EyiLb81z+A5wNzgRCm+rmmPekvvhzXoCyvWzrvCAKk7SuuSvWvK:JDgjvwyiH8Fxw1etyPPeMroKPvZVOvbu

    Score
    3/10
    execution
    behavioral3

    • Target

      WaveKeyGen/WaveKeyGen.csproj

    • Size

      392B

    • MD5

      0428968d85403d958c20ea59d1e9a53a

    • SHA1

      e270b1a3706e4de997d8b7d23a9b8cd18b11bfb7

    • SHA256

      ccb6259a2206f6c6ed702d557047f1ba56ad0fd80bee442ce59ef593aa363999

    • SHA512

      591dac2799ece69615f8c6a487e9e7248c31472877219ea16c5c5bcb90ad60382fe46e02fd94db70418bfe9c467c3786902a50aa772c4f049f51f9fd31d16a18

    Score
    3/10
    behavioral4

    • Target

      WaveKeyGen/obj/Debug/net8.0/.NETCoreApp,Version=v8.0.AssemblyAttributes.cs

    • Size

      198B

    • MD5

      9b225453b5a8008eefb62f6c5c66ce15

    • SHA1

      2d7e2b0e8efdd036ed252c9e551961db0d46f60c

    • SHA256

      f7a5d9789c863625e139ff99e1113a503830f6b85a88f6129916df83ac76b49e

    • SHA512

      7db7f838db345965a0ab671cdc68f223119f3eaaefd873aabbd4406f572741afe2e743d56fd0c8744ac3bba0e9c4e357855094a6c99f90cc16f7b535811790ee

    Score
    1/10
    behavioral5

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.AssemblyInfo.cs

    • Size

      963B

    • MD5

      21aad22597c1bcc649e551940808094b

    • SHA1

      b74e05a9c4e8bc42d4d5642de54293498bdd1aad

    • SHA256

      20be2868b8e02dc162aaf29c74e451288cd77b44f9d2308096a265ed91367a31

    • SHA512

      ca56b89071c1e4384f1d5019b3c26892e2a09500a97b5954ff718f9ff333e640bec93c1d9b2450fabfa2db9dcd2f18b06aaa1ba30b7a93ede21ef7f253012cca

    Score
    3/10
    behavioral6

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.AssemblyInfoInputs.cache

    • Size

      66B

    • MD5

      d397eb7444a91ea639058c23d6aff339

    • SHA1

      02856a8e68005dc5fdd18dcd1bba71ee37879326

    • SHA256

      ecd8ecd3c137fb5738587d9ceb0d7cf03e8885e16224ef06488fd54ea9768fb7

    • SHA512

      b82d15902589e70947e1c7e6fc8ed62114196102bb0c54c777614be8785f62f5e63570d8d52a98681e65d4ac8af891734b8f0541941ad72771f85b702e3a5eca

    Score
    3/10
    behavioral7

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.GeneratedMSBuildEditorConfig.editorconfig

    • Size

      599B

    • MD5

      a823019b9a699820afdd8e5dfcd3c7dc

    • SHA1

      db5fed956e3332bc7c3c2a4d0ea868f815eeebf2

    • SHA256

      46fc31300588f92bec2ee0cd984dd2886914e17065838c747887b02b0c8cf57f

    • SHA512

      3718a1eb1af696cd5676660acc21547dcce87c482ed94e12546080fa11fab4c64904b8114e814dbfac901e1204d7300d6c16c9bd3829677479da0bdc53527aa3

    Score
    3/10
    behavioral8

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.GlobalUsings.g.cs

    • Size

      295B

    • MD5

      0ca42cbc4f22da0578a209aaeb544bf8

    • SHA1

      35d3b87fe8da7bfccdcffa070e3bb6be112a4e34

    • SHA256

      f3f134e9e825e3e7268090f58b1af2bda2de513f61a09c56f48b9b8d08612abc

    • SHA512

      141cb3ae60964d43293e04c481c7ffa76cd5ca1061cbd9ff4205d928e5260608d70adbb6ca98b94bf849aab2ff5fcb2bb53f51d707425b1a6105bf5b0aba8395

    Score
    3/10
    behavioral9

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.assets.cache

    • Size

      22KB

    • MD5

      660c4417d85a12238745f111f1c7162d

    • SHA1

      fd207f8b88a96273fa15d2eb88bc91da8d44f065

    • SHA256

      715e840bce14560cc4b6f0a5c05bc17f8eb8e985b1e0e96235c06d17f1cefae6

    • SHA512

      b51fa8898dca71b503e06525427de69d176c87642fe4a241f9adb51c34c3d4d812988b0ac8b8615ac4ba0b2c66291fdc138328fc0a23dcd7073f266b9cc56a9b

    • SSDEEP

      192:ez4y4I6Tm6JZeHhMGDiAm1SiOVkNt3cP+ru1lG3eKvQCmb:ezMI6TmHFiAm1kVkNt3cTlfKvQCmb

    Score
    3/10
    behavioral10

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.csproj.AssemblyReference.cache

    • Size

      14KB

    • MD5

      6b93f4b407fdea6b874ca4a837de780e

    • SHA1

      f3248256baf74ba9d531c17dc6ce09252fead82b

    • SHA256

      3b6755c066a49f136de2567993ffeb2c25df156d32a1ec6c61f5f12f4aa31ae3

    • SHA512

      bbc5423fc594455305c41274ff4c562d287e159252d03d36cae78c4fffc6b82a505d7022a9ce74b11ad48a49132a29e0b6fd331c1f7bd95611ac35f17b627f59

    • SSDEEP

      192:10+Wy+KESeYT10vTLGEv/wbvyeXxIF5xMNCqh7auga:10+Wy+KESeYB2RobvyeXxIF5xMNC+Ou7

    Score
    3/10
    behavioral11

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.csproj.CoreCompileInputs.cache

    • Size

      66B

    • MD5

      58e8bb011399a522f9a7ebee7a2ad16e

    • SHA1

      ae92baed3bef142d6d48c3d552d47126a9cc05d4

    • SHA256

      9d76ef2da1296c1a5a1e2cc81cd141e1717264bdd2ffe37f92e95d54b447ff5e

    • SHA512

      acaa31d672274ce072a0f864dbca24aebdee3c8b39bde66fdd38efef92036b9f4d196bfdab259d6a5125d6d00e4a4793dd58cc95a0f25596049bbd4f8a215a55

    Score
    3/10
    behavioral12

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.csproj.FileListAbsolute.txt

    • Size

      4KB

    • MD5

      6667710f15e0e918fe8ed02c7c3831ef

    • SHA1

      97b6579c65b34e0b40481fdcf6804edde25947e3

    • SHA256

      fcb2ff27e67e48ac296dbdcd7d842ac2cb8825841a1bdf63468ca25f92e93394

    • SHA512

      f0652024d008457cf543e00e4117670fe37522dcf65174fc8c9543a9005b8f51bf2fad64b190329f1e71b1d137e1f685d574c030fca1f8f66b64e68764288390

    • SSDEEP

      96:owD9DkzwtXRx/Q9KcYscrOzUyLuzN3QlfXBKDVE:os48cuDK

    Score
    3/10
    behavioral13

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.dll

    • Size

      25KB

    • MD5

      94b21b9808e8dc5f74195f4caa75c450

    • SHA1

      eef369d47174c6508cfdb024adc9f70ccc99411c

    • SHA256

      bca32ed5b312f35517766d358a8d1955b2edf209b02ee521ac2f9884757e5bb2

    • SHA512

      bb7cd1677684df10817a4b318cdabe1a8cd1fd8d2db346870f812d1f57953f2e0db154397d26be883ab90c66886f437d7bf5e53fc0a66ddb6071dd62cb5d1989

    • SSDEEP

      384:ERO4SvKNTCECTB+uJJrr8tL/cXqJYS7GQ/eHbfEkw04XQlhVlxWZL:EkXvKNWE6+u4Fc3Pb1m9

    Score
    1/10
    behavioral14

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.genruntimeconfig.cache

    • Size

      66B

    • MD5

      2906d5a1418ac16116901ff064d4907a

    • SHA1

      919ee53fb4f700ebff6b469676b7dacf832de126

    • SHA256

      b6583a3069434eb381b947b3cd9e4de35e7c42f10cfc1666c80daa5ede96b508

    • SHA512

      ebe797ca1f529b58f491d4745314ceafe2015ce6504938888970605cb0db6b186d704ea2b83dab6dfd532206a8702a532816aec4a6f0f5813953abd3e62fd4c6

    Score
    3/10
    discovery
    behavioral15

    • Target

      WaveKeyGen/obj/Debug/net8.0/WaveKeyGen.pdb

    • Size

      16KB

    • MD5

      697cdba7cd0e0303f3649152f91c0f3d

    • SHA1

      f0a65b54f215a31cd532fffec1d9e7c6e8084f93

    • SHA256

      3e9a46f8fb0bb697615e6daebff54f52c2f1f723ca2bacff7bf26d9745f66fe2

    • SHA512

      2a3860e1a265fe3c4cf2beb0bc76ff901bd88db0628d3706a6f69a3d384bf2fd5899920c4959deec40f2997a798a58591235f60c071297c2463d269772a4f5dd

    • SSDEEP

      384:1Yi38ZrTI3FFtmfCZbd+auMDDtSHaT+LAVhkXIhvtR3YeayHVfIUXP8RHGucDe/D:14ZPI33t7wAnJvIRBWu

    Score
    3/10
    behavioral16

    • Target

      WaveKeyGen/obj/Debug/net8.0/apphost.exe

    • Size

      139KB

    • MD5

      25da26aae0279ebba8f47c9d3f77db92

    • SHA1

      b608964dbe284d481c461bee63aebd6a09d680d6

    • SHA256

      d21150e57fef185abf3213a4a51e1cd6bb56cb2b491e0a9643e9651434b8c768

    • SHA512

      80d31ba8c336fd8bac9de9feb56f4c3e60a006703b6c0014ffdf3398020911f3146847ce17d06ec5179cdd54639ce9e8b495f49c09887191537f49c5d23a2003

    • SSDEEP

      3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJu8ltf:miS4ompB9S3BZi0a1G78IVhcUct

    Score
    1/10
    behavioral17

    • Target

      WaveKeyGen/obj/Debug/net8.0/ref/WaveKeyGen.dll

    • Size

      11KB

    • MD5

      b469f0d19fe34a33361dd228945df291

    • SHA1

      662679b8353aeeef6b4e578a217a606d8a99c42c

    • SHA256

      e0b35ca5f2e92a7a9c1578eabcc2e686743a9a5e8a454bec46eb521ececc21a7

    • SHA512

      be0f2fafeeb5a4f76511c51bd5add4716729e5885f4ffa27f742d9bec00b2a0e6740996b42843dc51877334bb1be1f68282964a3b8dfa5dba0b5d1d75a635267

    • SSDEEP

      192:qTe4e+q14raaTs68qqu9p4OgtwXUb9EObmGVgVlxWZLv:qPJqKraus68q74O8b9EOCGOVlxWZL

    Score
    1/10
    behavioral18

    • Target

      WaveKeyGen/obj/Debug/net8.0/refint/WaveKeyGen.dll

    • Size

      11KB

    • MD5

      b469f0d19fe34a33361dd228945df291

    • SHA1

      662679b8353aeeef6b4e578a217a606d8a99c42c

    • SHA256

      e0b35ca5f2e92a7a9c1578eabcc2e686743a9a5e8a454bec46eb521ececc21a7

    • SHA512

      be0f2fafeeb5a4f76511c51bd5add4716729e5885f4ffa27f742d9bec00b2a0e6740996b42843dc51877334bb1be1f68282964a3b8dfa5dba0b5d1d75a635267

    • SSDEEP

      192:qTe4e+q14raaTs68qqu9p4OgtwXUb9EObmGVgVlxWZLv:qPJqKraus68q74O8b9EOCGOVlxWZL

    Score
    1/10
    behavioral19

    • Target

      WaveKeyGen/obj/Release/net8.0/.NETCoreApp,Version=v8.0.AssemblyAttributes.cs

    • Size

      198B

    • MD5

      9b225453b5a8008eefb62f6c5c66ce15

    • SHA1

      2d7e2b0e8efdd036ed252c9e551961db0d46f60c

    • SHA256

      f7a5d9789c863625e139ff99e1113a503830f6b85a88f6129916df83ac76b49e

    • SHA512

      7db7f838db345965a0ab671cdc68f223119f3eaaefd873aabbd4406f572741afe2e743d56fd0c8744ac3bba0e9c4e357855094a6c99f90cc16f7b535811790ee

    Score
    1/10
    behavioral20

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.AssemblyInfo.cs

    • Size

      965B

    • MD5

      73155010c19496a710e5968a589c8117

    • SHA1

      aa5e632e10db3c9692f4c4bf9ecfd91e1cf74d2f

    • SHA256

      b518cef08ecb717b1db9b3b7af3ab68299b5b7acb46fe7efd12cc36e511bbb51

    • SHA512

      02884a1b1b59ad24082ddc55a571baf825a429550ec96bd1a8c8e77f36db569f954595202c2d86e09f4613b2d448a25fbd3161f110e7001dd069c8637e6cea27

    Score
    3/10
    behavioral21

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.AssemblyInfoInputs.cache

    • Size

      66B

    • MD5

      132e1e7207812da59018cc46813733ff

    • SHA1

      8bd80319f7a3fd14566bd8066e05f7fa71400615

    • SHA256

      ec2f478d44b0f447d1e1e65ef5cad27521d6b6177ac4db448d7fd901a43f9590

    • SHA512

      8e98bd44aa9578ac0495cf01d32aab408db60d992829731556ab388e7315dd1c69acb77c72c7355eca382350839ef7c51b75aa9b6e2b800b4b9cde89eea4b459

    Score
    3/10
    behavioral22

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.GeneratedMSBuildEditorConfig.editorconfig

    • Size

      599B

    • MD5

      a823019b9a699820afdd8e5dfcd3c7dc

    • SHA1

      db5fed956e3332bc7c3c2a4d0ea868f815eeebf2

    • SHA256

      46fc31300588f92bec2ee0cd984dd2886914e17065838c747887b02b0c8cf57f

    • SHA512

      3718a1eb1af696cd5676660acc21547dcce87c482ed94e12546080fa11fab4c64904b8114e814dbfac901e1204d7300d6c16c9bd3829677479da0bdc53527aa3

    Score
    3/10
    behavioral23

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.GlobalUsings.g.cs

    • Size

      295B

    • MD5

      0ca42cbc4f22da0578a209aaeb544bf8

    • SHA1

      35d3b87fe8da7bfccdcffa070e3bb6be112a4e34

    • SHA256

      f3f134e9e825e3e7268090f58b1af2bda2de513f61a09c56f48b9b8d08612abc

    • SHA512

      141cb3ae60964d43293e04c481c7ffa76cd5ca1061cbd9ff4205d928e5260608d70adbb6ca98b94bf849aab2ff5fcb2bb53f51d707425b1a6105bf5b0aba8395

    Score
    3/10
    behavioral24

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.assets.cache

    • Size

      22KB

    • MD5

      aa87c99f5fcba62d3b511d4cad4b886c

    • SHA1

      4435571a8618a54cc420983204c156600a27a76f

    • SHA256

      f6cad8d1f5babdef8bceee48ec96bdf8c9aedd4b7aab83d368d20fae984295fc

    • SHA512

      d5f87ce02412eec0ee58fcb20881c5457d809f25b19dbe45c7c7c5440b94b92c31184a4c2163d5a6a52c90918eaca7ec4d76a6dce2148056bf565efecfd7b228

    • SSDEEP

      192:7z4y4I6Tm6JZeHhMGDiAm1SiOVkNt3cP+ru1lG3eKvQCmb:7zMI6TmHFiAm1kVkNt3cTlfKvQCmb

    Score
    3/10
    behavioral25

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.csproj.AssemblyReference.cache

    • Size

      14KB

    • MD5

      6b93f4b407fdea6b874ca4a837de780e

    • SHA1

      f3248256baf74ba9d531c17dc6ce09252fead82b

    • SHA256

      3b6755c066a49f136de2567993ffeb2c25df156d32a1ec6c61f5f12f4aa31ae3

    • SHA512

      bbc5423fc594455305c41274ff4c562d287e159252d03d36cae78c4fffc6b82a505d7022a9ce74b11ad48a49132a29e0b6fd331c1f7bd95611ac35f17b627f59

    • SSDEEP

      192:10+Wy+KESeYT10vTLGEv/wbvyeXxIF5xMNCqh7auga:10+Wy+KESeYB2RobvyeXxIF5xMNC+Ou7

    Score
    3/10
    behavioral26

    • Target

      WaveKeyGen/obj/Release/net8.0/WaveKeyGen.dll

    • Size

      23KB

    • MD5

      542b4f836e1d9fbda43dad713bc2ac20

    • SHA1

      fe20c47098d6e6c961f8b101cc26eba2a7f03ae6

    • SHA256

      87eb739f94da4a80e1e5e428e321f909c5c8a86532f0ea9739ecdabd6b620971

    • SHA512

      b52e5ecb864e9b4dc69e0a95395950c2aadf2da4a23d3261077aae80a39a567f30cac5924b757db7c996c46e61c74c294280449c9bca8caadb811554c88bfc99

    • SSDEEP

      384:auhlTPp2iYfSzYrOTX7YfN2bXrpY7GQJeHbfEkwPGyRZYVlxWZL:aABWSvXMlad1b0l

    Score
    1/10
    behavioral27

    • Target

      WaveKeyGen/obj/Release/net8.0/apphost.exe

    • Size

      139KB

    • MD5

      25da26aae0279ebba8f47c9d3f77db92

    • SHA1

      b608964dbe284d481c461bee63aebd6a09d680d6

    • SHA256

      d21150e57fef185abf3213a4a51e1cd6bb56cb2b491e0a9643e9651434b8c768

    • SHA512

      80d31ba8c336fd8bac9de9feb56f4c3e60a006703b6c0014ffdf3398020911f3146847ce17d06ec5179cdd54639ce9e8b495f49c09887191537f49c5d23a2003

    • SSDEEP

      3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJu8ltf:miS4ompB9S3BZi0a1G78IVhcUct

    Score
    1/10
    behavioral28

    • Target

      WaveKeyGen/obj/Release/net8.0/ref/WaveKeyGen.dll

    • Size

      11KB

    • MD5

      5f9d58deedacb41f874f3fb9fa8bf0e5

    • SHA1

      b29d178658b40f9c981f146c39aefac755f0cb68

    • SHA256

      9a48b8a0fe95b6c31ccdb704d88e13e183140018f3966295ed988166c98e21ce

    • SHA512

      3a1b0a9842ae3c8206fa0c93b9c81a5ba73a8ed0cc35cfc94b38643319d821c27d49fdc345defbd77f5d70932d71ca3231e6ea6228d34c0c8a7c7da86efadebc

    • SSDEEP

      192:th4Hase6qCoVgiJqfuEqx4O7zwXUJ9ENb4vVlxWZLv:jUOg7uEw4ODJ9ENeVlxWZL

    Score
    1/10
    behavioral29

    • Target

      WaveKeyGen/obj/Release/net8.0/refint/WaveKeyGen.dll

    • Size

      11KB

    • MD5

      5f9d58deedacb41f874f3fb9fa8bf0e5

    • SHA1

      b29d178658b40f9c981f146c39aefac755f0cb68

    • SHA256

      9a48b8a0fe95b6c31ccdb704d88e13e183140018f3966295ed988166c98e21ce

    • SHA512

      3a1b0a9842ae3c8206fa0c93b9c81a5ba73a8ed0cc35cfc94b38643319d821c27d49fdc345defbd77f5d70932d71ca3231e6ea6228d34c0c8a7c7da86efadebc

    • SSDEEP

      192:th4Hase6qCoVgiJqfuEqx4O7zwXUJ9ENb4vVlxWZLv:jUOg7uEw4ODJ9ENeVlxWZL

    Score
    1/10
    behavioral30

    • Target

      WaveKeyGen/src/Handlers/WebRequest/IHttpHandler.cs

    • Size

      3KB

    • MD5

      c41a22692784559695fa5df44636fc52

    • SHA1

      bf4209d436508e397f744ffe87389e3681211890

    • SHA256

      d1296e6340d81aeb4d93e2d3031b1007f5a46530456af9862d82471e4c85096a

    • SHA512

      4ef2895b7dbbaf579577d50bfdea9dc64cf4944cd5a57121b6c13903b0bf695acc372ab63a36e22f262bda8df470b73f16063883a91ba082d4bfcc0193fd073e

    Score
    3/10
    execution
    behavioral31

    • Target

      WaveKeyGen/src/Logger/ILogger.cs

    • Size

      1KB

    • MD5

      d4dc679e0caf584b306216a471d093cd

    • SHA1

      b192756a9c89f8a166a780636afb11974d8e9426

    • SHA256

      918137c27d9c9b70ef0e46a0ea79e98789a04cca5a670fe7b00e5049d9aec0d2

    • SHA512

      25e678b04894f8a1d6845e787d0e9986424d03dd29728b23952bf9e2bd33ab20b986265a89b818f3b89542b4c25f4f6da4207e62c0cf564e82c93b23ab676a7f

    Score
    3/10
    execution
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Process Discovery

1
T1057

Query Registry

3
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

System Network Connections Discovery

1
T1049

System Time Discovery

1
T1124

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

exelastealercollectioncredential_accessdefense_evasiondiscoveryevasionpersistenceprivilege_escalationpyinstallerspywarestealerupx
Score
10/10

behavioral2

Score
3/10

behavioral3

execution
Score
3/10

behavioral4

Score
3/10

behavioral5

Score
1/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

Score
1/10

behavioral15

discovery
Score
3/10

behavioral16

Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10