Overview

overview

10

Static

static

3

Sniper 17....ia.exe

windows11-21h2-x64

Stub.pyc

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sniper 17.11.24.zip

  • Size

    10.6MB

  • Sample

    241205-1yrscazrbr

  • MD5

    f4454a41224ffdcd7d8d28d9cd64262d

  • SHA1

    8113c7d91272ea7e44b8b6c7d33cb2ed0c3bd24a

  • SHA256

    516f36909316473913107bf8a3672e6586e5091eff66a3f9d698817f626b8a8f

  • SHA512

    c71f6941da71eb6d2dde9b53ce0d808c46faf9fd08e7518f0430360fd3b33abd0ba242b5e6d6f2f707618bf2e6bbae4cda75ebb3cd4420a278213b36f6973977

  • SSDEEP

    196608:I3SJBZNBa35DGP3Iq/AOOPCz3XtXg9WhyaxKjTbl1k+fuEiYSkzs:lTa35DCn/nOqz3XW+Z4jlRAkzs

Score
10/10
exelastealercollectiondefense_evasiondiscoveryevasionpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      Sniper 17.11.24/Roblox Sniper/snipemania.exe

    • Size

      10.8MB

    • MD5

      77ae59ba29b4f49eb0e79f5cee225ddf

    • SHA1

      b6b8f720cb86be6ce9c8f866be783b44f6fbfb26

    • SHA256

      f6e9058833929bb527520291381b258da8cae37db65cdecd95d06971b93daa9a

    • SHA512

      eb08371ba4b060f4d03337d1611d999947137a5a6bedef1bee1548e013bf796c44aa4b1cb06594afc44b787135745ba22b66ad26c604dffd6a9cd523dfd6781f

    • SSDEEP

      196608:8UXm51flz2Jp5UfLuiB6yavnlPzf+JiJCsVMvHTynKFDhSiJSamx:eh2Jp5MlBRavnlPSa7WvuexXmx

    Score
    10/10
    exelastealercollectiondefense_evasiondiscoveryevasionpersistenceprivilege_escalationpyinstallerspywarestealerupx

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Exelastealer family

      exelastealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      Stub.pyc

    • Size

      874KB

    • MD5

      ea37db674a41c8a28e749a1f00b9db19

    • SHA1

      99406bbef813c86d75175c94d2dfe7e844d71e35

    • SHA256

      f761c2ef168baef90d72aa42657e3d7475ad633fd698fa4ff6c2e1f2d3b5b030

    • SHA512

      6bdadb323dd19744f5885a38b24d272a40cef249313138155cca63904123b13bc7d876d530e118b54bdb312669b623d72e86c5c19780413136abe9bac692e626

    • SSDEEP

      12288:K3LGlJDl/8c25sfdiO3bm9qd07OY0bgrSA73xWcvw40pV6M3qsbWo:25b54sL940MgGALxEV67sbWo

    Score
    3/10
    behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Process Discovery

1
T1057

System Information Discovery

4
T1082

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks