General
-
Target
d5b0f260bc71c5d65d075add4186c15ac68d676191ad4cf207f95a8c0bcfb6bf.exe
-
Size
396KB
-
Sample
241110-dkbgwa1mhj
-
MD5
4788afa2fd8b4d90e6fd1d18bbb88f48
-
SHA1
2f8021e35e775898244a0be54c5eb37ca6b65ea7
-
SHA256
d5b0f260bc71c5d65d075add4186c15ac68d676191ad4cf207f95a8c0bcfb6bf
-
SHA512
be06e5ceec0fbdb07025a6275a6af5a865a1d47d87dadafaf39230b6187caa0621f127297d1daed1298462ceb546a2012ee61c1a51f0f755d3be8e019faaba18
-
SSDEEP
6144:rbODqpwPEuxGH6OrwX3pwzZwEq7EtE6xBpgwSOm92BUz7BJwaPEqrPlTux0:ryPPDLOrwX3pwzZwGB7k2uvfwARI0
Behavioral task
behavioral1
Sample
d5b0f260bc71c5d65d075add4186c15ac68d676191ad4cf207f95a8c0bcfb6bf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5b0f260bc71c5d65d075add4186c15ac68d676191ad4cf207f95a8c0bcfb6bf.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
sharpstealer
https://api.telegram.org/bot7813335994:AAF06QjFbKeU5g2fyVosbcjJo-OGDToKI_0/sendMessage?chat_id=1713921305
-
max_exfil_filesize
1.5e+06
-
proxy_port
168.235.103.57:3128
-
vime_world
false
Targets
-
-
Target
d5b0f260bc71c5d65d075add4186c15ac68d676191ad4cf207f95a8c0bcfb6bf.exe
-
Size
396KB
-
MD5
4788afa2fd8b4d90e6fd1d18bbb88f48
-
SHA1
2f8021e35e775898244a0be54c5eb37ca6b65ea7
-
SHA256
d5b0f260bc71c5d65d075add4186c15ac68d676191ad4cf207f95a8c0bcfb6bf
-
SHA512
be06e5ceec0fbdb07025a6275a6af5a865a1d47d87dadafaf39230b6187caa0621f127297d1daed1298462ceb546a2012ee61c1a51f0f755d3be8e019faaba18
-
SSDEEP
6144:rbODqpwPEuxGH6OrwX3pwzZwEq7EtE6xBpgwSOm92BUz7BJwaPEqrPlTux0:ryPPDLOrwX3pwzZwGB7k2uvfwARI0
Score10/10-
Sharp Stealer
Sharp Stealer is an infostealer first observed in 2024, based on Echelon and Umbral stealers.
-
Sharpstealer family
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-