General

  • Target

    linax spoofer.rar

  • Size

    8.1MB

  • Sample

    241130-treqwasnbj

  • MD5

    614d22468d43794dccbbe5840a4acb3a

  • SHA1

    702f07aa6d102ada270bf83d63dda3c36653ad7d

  • SHA256

    6b258b27942e552bb3ba9acf58b80d4c050b3a820484b1ec9c6eb3a823fd36c9

  • SHA512

    64b6b6dc78a3b4de53315f990ee40adae8649a5aef3efabb84e8fe57b253a2796461f35d8cee0112266b95a6d51d2eead8bab03b92607ce13989974e7094dd5a

  • SSDEEP

    196608:col+u1kF9pMQqVpQ56/7ZFCJZGHBmPXy2poVsHvZpd8CLBnVdILQYWW/8:RldG9pIjQ5eFCJ2BmXyAoVuL5co1

Malware Config

Targets

    • Target

      linax spoofer.exe

    • Size

      8.3MB

    • MD5

      23166bc6ef40688545adacc4591c4835

    • SHA1

      eeccd22c7e385610e1da420d37d91dc6326b972e

    • SHA256

      bb6b4af96499c32fe6ceddd9790a101a4b03fc1846baae1cb874d0cf3b1f1f9d

    • SHA512

      ec724888b84486cda3d0c8dd63c9503345666a6c952f91f5e314d38c90b29a3c63cf9e1e7346b0959b5081801c38cbff8af7d932c22637eac92aa927f8169115

    • SSDEEP

      196608:cMyxurErvI9pWjgaAnajMsbSEo2CfQCS/OinHC1h:jyxurEUWjJjIfRoPhHYh

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks