General
-
Target
Spotify.exe
-
Size
7.9MB
-
Sample
241112-rrthxstkev
-
MD5
d875b17674953b2d6fc177f79b78d69a
-
SHA1
9479d37846ed4e878fcae093f3ff49f251851170
-
SHA256
d4053edc79ee84fe374bb91a8a1333f3c9a820d99fad6ca8cb1cf20d32992417
-
SHA512
49bff4e09f92ecca0aeefe58475e14a4b2a316efb74e66bda3902b3a642dc286f76fdc7a7bd06914833887f2559ba38e5f9390fc6c35542219b7cd021f92c378
-
SSDEEP
196608:1gQdj4O9LgRRHG94UEbrURbsvnEJlQ9aNx1pLr:1dX2RRmqUEbwRbsvnIG92x1B
Static task
static1
Behavioral task
behavioral1
Sample
Spotify.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Spotify.exe
-
Size
7.9MB
-
MD5
d875b17674953b2d6fc177f79b78d69a
-
SHA1
9479d37846ed4e878fcae093f3ff49f251851170
-
SHA256
d4053edc79ee84fe374bb91a8a1333f3c9a820d99fad6ca8cb1cf20d32992417
-
SHA512
49bff4e09f92ecca0aeefe58475e14a4b2a316efb74e66bda3902b3a642dc286f76fdc7a7bd06914833887f2559ba38e5f9390fc6c35542219b7cd021f92c378
-
SSDEEP
196608:1gQdj4O9LgRRHG94UEbrURbsvnEJlQ9aNx1pLr:1dX2RRmqUEbwRbsvnIG92x1B
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3