General
-
Target
Built.exe
-
Size
6.9MB
-
Sample
241030-qx5mpsvbjb
-
MD5
f75c706c64f579f7ece7505fed2988c4
-
SHA1
453443ef836f489c2d692e09ac83223b033c248e
-
SHA256
7b6cf44daf95b37342974ceb49c3d78d954f9ccbef6ef3273211c1d497a38b55
-
SHA512
5387d8a3fa730d671fb22c09ba55ea1c2ce4c62e72be0f17d79f5bb06c7ec82570d981ca532ee8acca2f21f880a0f0a6d23842fbd0a266560b5d9cd2d8135796
-
SSDEEP
98304:fIDjWM8JEE1FVHamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIFm:fI0bqeNTfm/pf+xk4dWRpmrbW3jmrO
Malware Config
Targets
-
-
Target
Built.exe
-
Size
6.9MB
-
MD5
f75c706c64f579f7ece7505fed2988c4
-
SHA1
453443ef836f489c2d692e09ac83223b033c248e
-
SHA256
7b6cf44daf95b37342974ceb49c3d78d954f9ccbef6ef3273211c1d497a38b55
-
SHA512
5387d8a3fa730d671fb22c09ba55ea1c2ce4c62e72be0f17d79f5bb06c7ec82570d981ca532ee8acca2f21f880a0f0a6d23842fbd0a266560b5d9cd2d8135796
-
SSDEEP
98304:fIDjWM8JEE1FVHamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIFm:fI0bqeNTfm/pf+xk4dWRpmrbW3jmrO
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-