Resubmissions

18-11-2024 22:14

241118-15419awelh 10

General

  • Target

    Exela.exe

  • Size

    13.8MB

  • Sample

    241118-15419awelh

  • MD5

    6258157bff96caf2b7bcb50e809dd571

  • SHA1

    e39f2842e37a6a9a6107484bf99be4c057d99100

  • SHA256

    7ddaa908394489b78f31be5f297290709b0fae604686c6e8ebc81a631d5bd1a0

  • SHA512

    08c2e992c728e3fd11c3cedd923b107111cfec57cb9de684db542e161f4be2ba9b862f89972e13235a1a96f25f56b274faad39b2f33d5c3129006d9c376e3f21

  • SSDEEP

    393216:fJJyitByxjBIn8iK1piXLGVEcBSr+SllsgkYkG2a:fiitAjhDiXHMSrHX2a

Malware Config

Targets

    • Target

      Exela.exe

    • Size

      13.8MB

    • MD5

      6258157bff96caf2b7bcb50e809dd571

    • SHA1

      e39f2842e37a6a9a6107484bf99be4c057d99100

    • SHA256

      7ddaa908394489b78f31be5f297290709b0fae604686c6e8ebc81a631d5bd1a0

    • SHA512

      08c2e992c728e3fd11c3cedd923b107111cfec57cb9de684db542e161f4be2ba9b862f89972e13235a1a96f25f56b274faad39b2f33d5c3129006d9c376e3f21

    • SSDEEP

      393216:fJJyitByxjBIn8iK1piXLGVEcBSr+SllsgkYkG2a:fiitAjhDiXHMSrHX2a

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Exelastealer family

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks