Overview

overview

9

Static

static

3

main.exe

windows11-21h2-x64

9

Resubmissions

12/09/2024, 17:54

240912-whdhkawfmh 9

12/09/2024, 17:49

240912-wd77dawelc 9

Sharing

Copy URL Twitter E-mail

General

  • Target

    main.exe

  • Size

    12.8MB

  • Sample

    240912-wd77dawelc

  • MD5

    8cd5e707d948dabc1541733986f139d7

  • SHA1

    66f07c830fd8036eca16a7a1508d8b8c0f475e77

  • SHA256

    327157fc30929192b05f146de24147df061efd1de82647f339c0c86bc35bdc0c

  • SHA512

    b52e24df799401754b4c0d426656df6d57a34c895826efa6273b45287d5cd4f6a2d843ef5bde6a4854402ef0097164c8b9490bf0f97a86af0e3e3e7cae46c72e

  • SSDEEP

    393216:ZaCJpgPYVnNSMxXMCHWUjrjx5WsqWxT45xHMrl9W89VwaYlG:ZaCJpgPQbXMb8GsqAAMh9W8jt7

Score
9/10
credential_accessdiscoverypyinstallerransomwarespywarestealer

Malware Config

Targets

    • Target

      main.exe

    • Size

      12.8MB

    • MD5

      8cd5e707d948dabc1541733986f139d7

    • SHA1

      66f07c830fd8036eca16a7a1508d8b8c0f475e77

    • SHA256

      327157fc30929192b05f146de24147df061efd1de82647f339c0c86bc35bdc0c

    • SHA512

      b52e24df799401754b4c0d426656df6d57a34c895826efa6273b45287d5cd4f6a2d843ef5bde6a4854402ef0097164c8b9490bf0f97a86af0e3e3e7cae46c72e

    • SSDEEP

      393216:ZaCJpgPYVnNSMxXMCHWUjrjx5WsqWxT45xHMrl9W89VwaYlG:ZaCJpgPQbXMb8GsqAAMh9W8jt7

    Score
    9/10
    credential_accessdiscoveryransomwarespywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Renames multiple (2919) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks