Overview

overview

10

Static

static

10

mlode27gb.mega.rar

windows7-x64

8

mlode27gb.mega.rar

windows10-2004-x64

3

mlode27gb.mega.exe

windows7-x64

7

mlode27gb.mega.exe

windows10-2004-x64

7

main.pyc

windows7-x64

3

main.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mlode27gb.mega.rar

  • Size

    17.6MB

  • Sample

    241008-snclnswdmf

  • MD5

    fd9af755a885dc8d3ca202b85ea5de3c

  • SHA1

    3bd012bf915c0d42f14736741295eb2c8f29d4ee

  • SHA256

    36b39ead8c247bad509fdc3a262a500fb2d1c7705d386d767d7a1396bb70738a

  • SHA512

    afc65651c6b26fe931572f39da99b254b40559859f565cd9c14c40427e794ff08e201506cb4f6819b31eb865190e070b9e97d13903caf91a793d1dc1a80299f2

  • SSDEEP

    393216:Ds+QtcKbFQQZrRmTjvndcUtM1FpVfEjtlSo:Ds+OBFQNvdcUtM1F7s

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      mlode27gb.mega.rar

    • Size

      17.6MB

    • MD5

      fd9af755a885dc8d3ca202b85ea5de3c

    • SHA1

      3bd012bf915c0d42f14736741295eb2c8f29d4ee

    • SHA256

      36b39ead8c247bad509fdc3a262a500fb2d1c7705d386d767d7a1396bb70738a

    • SHA512

      afc65651c6b26fe931572f39da99b254b40559859f565cd9c14c40427e794ff08e201506cb4f6819b31eb865190e070b9e97d13903caf91a793d1dc1a80299f2

    • SSDEEP

      393216:Ds+QtcKbFQQZrRmTjvndcUtM1FpVfEjtlSo:Ds+OBFQNvdcUtM1F7s

    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      mlode27gb.mega.exe

    • Size

      17.8MB

    • MD5

      ac2e992f676cc826485c2c0fd3587285

    • SHA1

      6927974e98fecba41dfe5f98dc67cf958272727e

    • SHA256

      6f87f78f0e85a206c8ac68366cac181613f7f9b1eb73bb274b435fd2188c3e85

    • SHA512

      e8705aa9381eb87bc574a0b1022ff685672901801df92b51b1dd6cba71119613b9937e45d3b5eada02a84c8aa7ee9f6da4915b81ba45672e61d53e10e0eb099f

    • SSDEEP

      393216:8qPnLFXlrPmQ8DOETgsvfGFggv8vEGoCmopCnSq:tPLFXNOQhEpmVlBop6

    Score
    7/10
    upxdiscoverypersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      main.pyc

    • Size

      7KB

    • MD5

      54ee26fd0ed29fd3983c04bd4fd35c68

    • SHA1

      ec2d7f38155874df79e8237811007d10dd5340a9

    • SHA256

      45ec6c2c9658adbee09ecc39fe5d1ae1367cb996a7cfa4d1699d8ee8e233005a

    • SHA512

      c3d3755ae57eb36c265a3650fa97d9d0c924414b7a8502c06182d9e07daab801b0aff7d06950f4425f07cbd1155dc0349bc11d7c239254ab0d22e303c9196350

    • SSDEEP

      192:whVA09D8j6/WdXwWSEJKEWQJhwvai9HuMdwbVYPnw:MVAVkWuUhW02vAP5YPw

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks