General
-
Target
Built.exe
-
Size
6.9MB
-
Sample
241031-3dj8wavdnj
-
MD5
17ad89c95b9c6bc7bc6d2b8618fafb11
-
SHA1
864d80465ccfb1f06f1f1e87379a2e79ce1de500
-
SHA256
3a4e6c11587a3fab9132ef8b4aaaf589300f01246de6da7ae1d2abf4ec6cf542
-
SHA512
35a09841a3d30bc6c50845694091f7533d71a317d57fbbcc6523877c7ce6beca84e4534219bceb65ad2cecacf9eba7b814ba89e829cd8d0a6bb363ad899bfbde
-
SSDEEP
98304:xVphDjWM8JEE1FiramaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEA:Jh0MOeNTfm/pf+xk4dWRpmrbW3jmrV
Malware Config
Targets
-
-
Target
Built.exe
-
Size
6.9MB
-
MD5
17ad89c95b9c6bc7bc6d2b8618fafb11
-
SHA1
864d80465ccfb1f06f1f1e87379a2e79ce1de500
-
SHA256
3a4e6c11587a3fab9132ef8b4aaaf589300f01246de6da7ae1d2abf4ec6cf542
-
SHA512
35a09841a3d30bc6c50845694091f7533d71a317d57fbbcc6523877c7ce6beca84e4534219bceb65ad2cecacf9eba7b814ba89e829cd8d0a6bb363ad899bfbde
-
SSDEEP
98304:xVphDjWM8JEE1FiramaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEA:Jh0MOeNTfm/pf+xk4dWRpmrbW3jmrV
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-