General

  • Target

    X8 Premium.rar

  • Size

    6.8MB

  • Sample

    241117-q1ycsszqet

  • MD5

    3440c6f3a2da60fcecf1de0085383242

  • SHA1

    ae1a5c9c80774298f0100421a1bd4fea4038c6cd

  • SHA256

    72647c16e20c2786ed9538fe3c775140bfc6111b0c3ebd499c26b7ed356acfe5

  • SHA512

    fe93fe2195dd88a8a0863b1f55b323c0edf919e0132cb032d5cba6aad282a82005c3e118be3f01429b0abd5b005e1b2bdb5957a320b4228585e2449bd5c5b58b

  • SSDEEP

    196608:f3ZwwONQFsq6pNxdV7SqX3asJI7sFc0/wr:fJ6dpNA63aKtN/4

Malware Config

Targets

    • Target

      X8 Premium.exe

    • Size

      6.9MB

    • MD5

      2f7748fd45aeaf00a397cc18b2866ea5

    • SHA1

      d1be34efac9079f34c6b2d27fa2499d43e521512

    • SHA256

      0e4b1d3cd122038cfce7d604803b9997d5846ed9a2fab96109a75a0dd16e8849

    • SHA512

      7570a483d3333675aa7ca309c6e5b60e9a47641b189e016a8298c6ebba2206f6b47c3b460850ea0210190194b8e1c7f0ae4ffe43a83b12946437ee80dd746b2e

    • SSDEEP

      98304:gnDjWM8JEE1FYdsMamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEE:gn0EeeNTfm/pf+xk4dWRpmrbW3jmrF

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      �l]�YIU.pyc

    • Size

      1KB

    • MD5

      865087349477dacf241f8aa1a01dd63a

    • SHA1

      46fc476233775c451ead92ef330a088bd26693fd

    • SHA256

      2d60cb16a57473193233967fbe9ddb11abd9ece156a6f57e7327437f65b26f56

    • SHA512

      42442340d4dd57ca5b3fb4e2f1da0627f4647fb144c3445266b8fb150701a1338fb626ac0211fabe96ae26d7cfa0b8ce954d1993ef68cfb6efca8afd2636f611

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks