General

  • Target

    linax spoofer.exe

  • Size

    8.3MB

  • Sample

    241130-tsszwsykby

  • MD5

    23166bc6ef40688545adacc4591c4835

  • SHA1

    eeccd22c7e385610e1da420d37d91dc6326b972e

  • SHA256

    bb6b4af96499c32fe6ceddd9790a101a4b03fc1846baae1cb874d0cf3b1f1f9d

  • SHA512

    ec724888b84486cda3d0c8dd63c9503345666a6c952f91f5e314d38c90b29a3c63cf9e1e7346b0959b5081801c38cbff8af7d932c22637eac92aa927f8169115

  • SSDEEP

    196608:cMyxurErvI9pWjgaAnajMsbSEo2CfQCS/OinHC1h:jyxurEUWjJjIfRoPhHYh

Malware Config

Targets

    • Target

      linax spoofer.exe

    • Size

      8.3MB

    • MD5

      23166bc6ef40688545adacc4591c4835

    • SHA1

      eeccd22c7e385610e1da420d37d91dc6326b972e

    • SHA256

      bb6b4af96499c32fe6ceddd9790a101a4b03fc1846baae1cb874d0cf3b1f1f9d

    • SHA512

      ec724888b84486cda3d0c8dd63c9503345666a6c952f91f5e314d38c90b29a3c63cf9e1e7346b0959b5081801c38cbff8af7d932c22637eac92aa927f8169115

    • SSDEEP

      196608:cMyxurErvI9pWjgaAnajMsbSEo2CfQCS/OinHC1h:jyxurEUWjJjIfRoPhHYh

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks