General

  • Target

    RangeSpoofer.exe

  • Size

    6.8MB

  • Sample

    241116-sws9dsyerc

  • MD5

    6fc5da89fb72aa64bb13fee26b0c3114

  • SHA1

    2a3554c4b191cf5713dd80e81287cb843d27c172

  • SHA256

    6a075e0cf00847ba9fc10ba7a8c5608ba59f443f41c6ffd6d3599255630f9b4b

  • SHA512

    de2a58c15dec88d28ec79d61a1246f1d4d7ad99c1eff64d09761f2edced4fae0f6701c0621e58491ae9b3fb09a7108b082907a7051a5cbf83c659bce849f6e2d

  • SSDEEP

    196608:h/umWfOjmFwDRxtYSHdK34kdai7bN3m5SE+wOaM:IWK2pM9B3QQWDM

Malware Config

Targets

    • Target

      RangeSpoofer.exe

    • Size

      6.8MB

    • MD5

      6fc5da89fb72aa64bb13fee26b0c3114

    • SHA1

      2a3554c4b191cf5713dd80e81287cb843d27c172

    • SHA256

      6a075e0cf00847ba9fc10ba7a8c5608ba59f443f41c6ffd6d3599255630f9b4b

    • SHA512

      de2a58c15dec88d28ec79d61a1246f1d4d7ad99c1eff64d09761f2edced4fae0f6701c0621e58491ae9b3fb09a7108b082907a7051a5cbf83c659bce849f6e2d

    • SSDEEP

      196608:h/umWfOjmFwDRxtYSHdK34kdai7bN3m5SE+wOaM:IWK2pM9B3QQWDM

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks