Overview

overview

10

Static

static

10

Compiled.exe

windows7-x64

7

Compiled.exe

windows10-2004-x64

7

main.pyc

windows7-x64

3

main.pyc

windows10-2004-x64

3

Resubmissions

21-10-2024 17:16

241021-vs5t5a1fpp 10

21-10-2024 16:10

241021-tmhxqsydqd 10

21-10-2024 16:06

241021-tkatcazhrk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Compiled.exe

  • Size

    17.6MB

  • Sample

    241021-tmhxqsydqd

  • MD5

    768e247338e44787bdb93e1a0036c4aa

  • SHA1

    ec03e146ea9d17128d711c0c0f7d5207525e8c87

  • SHA256

    e60bf348feccae294847b6d799e0349314579595f5eee9dab9400dbfd3edbe54

  • SHA512

    2db118ba2598d027d98f41b5f2308e0a46524ab8a7088d926b81362514d3fa2d14a1e0a18bef7ab2ad8ca4b24bfda556aafeb1cd73b27a33086a72f406aad0ee

  • SSDEEP

    393216:ZqPnLFXlrPUgQpDOETgsvfGA/g/4vEm/CCLb:QPLFXNPtQoEfaxvw

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      Compiled.exe

    • Size

      17.6MB

    • MD5

      768e247338e44787bdb93e1a0036c4aa

    • SHA1

      ec03e146ea9d17128d711c0c0f7d5207525e8c87

    • SHA256

      e60bf348feccae294847b6d799e0349314579595f5eee9dab9400dbfd3edbe54

    • SHA512

      2db118ba2598d027d98f41b5f2308e0a46524ab8a7088d926b81362514d3fa2d14a1e0a18bef7ab2ad8ca4b24bfda556aafeb1cd73b27a33086a72f406aad0ee

    • SSDEEP

      393216:ZqPnLFXlrPUgQpDOETgsvfGA/g/4vEm/CCLb:QPLFXNPtQoEfaxvw

    Score
    7/10
    discoveryupxpersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      main.pyc

    • Size

      7KB

    • MD5

      09518663caeda063776f6737284938e1

    • SHA1

      1b492e1c4880a509350c706678ea606ff6d2ece0

    • SHA256

      715c625cc1b148e504cccc4b354621b9b32697eeff344247d52ef02339dfb0e6

    • SHA512

      05bd58a5a7d9aa42d3643ce3e5179991634ae110eab54bc3ec68e6df346560e05802f9e46b28c5e040b7212903d9ce242606e875f27070517bcc2e5554757dda

    • SSDEEP

      192:wvP7VirD8fiVYWdXwk4YSk2kJhwjyyJ6PMdw3+7nw:8PJNBWukNSX42jy7Pyw

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks