Overview

overview

10

Static

static

3

supermain.exe

windows7-x64

7

supermain.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    supermain.exe

  • Size

    541KB

  • Sample

    240915-p84dcavhnm

  • MD5

    2f61a2fdad0599146e7546d577d3772d

  • SHA1

    281a57e57f2b415c35d5808f890da7e172a1a281

  • SHA256

    2ab5dd6218935db97e71e5578ceaa8f87ef7ac30574216662dc6c040136ff5cf

  • SHA512

    2830d7d546177138e0f6d2f02a47abe3bfbc05d776ea81780f0f605fe458811c67124e34cb135652f1e6a5a72b62a99640bca8796a3c9fd0360b50b3fe808dc3

  • SSDEEP

    12288:GCWMqsBLwNQD8gABE3u5p+hY/4ewg2ZNaKCmWyOfoJVtKtnjWGuWgbHOuSMqT/Yd:XuSOfgAB0

Score
10/10
xehookcredential_accessdiscoverystealer

Malware Config

Extracted

Family

xehook

Version

2.1.5 Stable

C2

https://t.me/+w897k5UK_jIyNDgy

Attributes
  • id

    208

  • token

    xehook208939115726271

Targets

    • Target

      supermain.exe

    • Size

      541KB

    • MD5

      2f61a2fdad0599146e7546d577d3772d

    • SHA1

      281a57e57f2b415c35d5808f890da7e172a1a281

    • SHA256

      2ab5dd6218935db97e71e5578ceaa8f87ef7ac30574216662dc6c040136ff5cf

    • SHA512

      2830d7d546177138e0f6d2f02a47abe3bfbc05d776ea81780f0f605fe458811c67124e34cb135652f1e6a5a72b62a99640bca8796a3c9fd0360b50b3fe808dc3

    • SSDEEP

      12288:GCWMqsBLwNQD8gABE3u5p+hY/4ewg2ZNaKCmWyOfoJVtKtnjWGuWgbHOuSMqT/Yd:XuSOfgAB0

    Score
    10/10
    discoveryxehookcredential_accessstealer

    • Xehook stealer

      Xehook is an infostealer written in C#.

      stealerxehook

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks