General
-
Target
RangeSpoofer.exe
-
Size
6.8MB
-
Sample
241116-sws9dsyerc
-
MD5
6fc5da89fb72aa64bb13fee26b0c3114
-
SHA1
2a3554c4b191cf5713dd80e81287cb843d27c172
-
SHA256
6a075e0cf00847ba9fc10ba7a8c5608ba59f443f41c6ffd6d3599255630f9b4b
-
SHA512
de2a58c15dec88d28ec79d61a1246f1d4d7ad99c1eff64d09761f2edced4fae0f6701c0621e58491ae9b3fb09a7108b082907a7051a5cbf83c659bce849f6e2d
-
SSDEEP
196608:h/umWfOjmFwDRxtYSHdK34kdai7bN3m5SE+wOaM:IWK2pM9B3QQWDM
Behavioral task
behavioral1
Sample
RangeSpoofer.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
RangeSpoofer.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
RangeSpoofer.exe
-
Size
6.8MB
-
MD5
6fc5da89fb72aa64bb13fee26b0c3114
-
SHA1
2a3554c4b191cf5713dd80e81287cb843d27c172
-
SHA256
6a075e0cf00847ba9fc10ba7a8c5608ba59f443f41c6ffd6d3599255630f9b4b
-
SHA512
de2a58c15dec88d28ec79d61a1246f1d4d7ad99c1eff64d09761f2edced4fae0f6701c0621e58491ae9b3fb09a7108b082907a7051a5cbf83c659bce849f6e2d
-
SSDEEP
196608:h/umWfOjmFwDRxtYSHdK34kdai7bN3m5SE+wOaM:IWK2pM9B3QQWDM
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Process Discovery
1Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1