Resubmissions

28-10-2024 20:32

241028-zbnazaxalp 10

27-09-2024 07:23

240927-h8aygavaka 10

General

  • Target

    applecperm.exe

  • Size

    14.3MB

  • Sample

    241028-zbnazaxalp

  • MD5

    9405b56af4d2bd0546ed27ed1d68b1ab

  • SHA1

    8c7d5c8563f621c2cffafc9ccd4a156cfb7ec8f8

  • SHA256

    6e997d7cdd07a8c173b569bedda6aaaf1b5ac10e5391a98c2f4593c5fc284b30

  • SHA512

    96c6b04730ba00d6ba1bc6f90fa1e484594a39fd83b4c22a2b8646cfb1220c20cf5dc819e63ef3100ca66a3c302eb00b1d3b564e034d34b7995c20c9befc21d4

  • SSDEEP

    393216:aiIE7YoPQMidQuslSq99oWOv+9fgEIlIQvew:D7rPQ3dQuSDorvSYEIpvf

Malware Config

Targets

    • Target

      applecperm.exe

    • Size

      14.3MB

    • MD5

      9405b56af4d2bd0546ed27ed1d68b1ab

    • SHA1

      8c7d5c8563f621c2cffafc9ccd4a156cfb7ec8f8

    • SHA256

      6e997d7cdd07a8c173b569bedda6aaaf1b5ac10e5391a98c2f4593c5fc284b30

    • SHA512

      96c6b04730ba00d6ba1bc6f90fa1e484594a39fd83b4c22a2b8646cfb1220c20cf5dc819e63ef3100ca66a3c302eb00b1d3b564e034d34b7995c20c9befc21d4

    • SSDEEP

      393216:aiIE7YoPQMidQuslSq99oWOv+9fgEIlIQvew:D7rPQ3dQuSDorvSYEIpvf

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks