Overview

overview

10

Static

static

10

skystealer...ain.py

windows7-x64

3

skystealer...ain.py

windows10-2004-x64

3

skystealer...ild.py

windows7-x64

3

skystealer...ild.py

windows10-2004-x64

3

skystealer...fig.py

windows7-x64

3

skystealer...fig.py

windows10-2004-x64

3

skystealer...env.py

windows7-x64

3

skystealer...env.py

windows10-2004-x64

3

skystealer...ate.py

windows7-x64

3

skystealer...ate.py

windows10-2004-x64

3

skystealer...fig.py

windows7-x64

3

skystealer...fig.py

windows10-2004-x64

3

skystealer...in.exe

windows7-x64

7

skystealer...in.exe

windows10-2004-x64

7

skystealer...bug.py

windows7-x64

3

skystealer...bug.py

windows10-2004-x64

3

skystealer...ken.py

windows7-x64

3

skystealer...ken.py

windows10-2004-x64

3

skystealer...ion.py

windows7-x64

3

skystealer...ion.py

windows10-2004-x64

3

skystealer...tup.py

windows7-x64

3

skystealer...tup.py

windows10-2004-x64

3

skystealer...nfo.py

windows7-x64

3

skystealer...nfo.py

windows10-2004-x64

3

skystealer...fig.py

windows7-x64

3

skystealer...fig.py

windows10-2004-x64

3

skystealer...ain.py

windows7-x64

3

skystealer...ain.py

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    skystealer-main.zip

  • Size

    17.9MB

  • Sample

    241207-bt9d6aykby

  • MD5

    de05aa3b3ffa7897e5fb753ee4153d58

  • SHA1

    51aeb2ee13da4c169d820d057f3455ccb241eae4

  • SHA256

    9e071b0e06143633463b14377fd3b77cb62b5be95a0c236dcef54e5325447402

  • SHA512

    e5fe56a979532121291e5834674536478bd7aa2816ba680c4fb8b233e5f282c8c348dfcab7476c46a2ebf3eb7554f88413f2b5e4259673f8d345a5460fcf86a7

  • SSDEEP

    393216:dkzptn7jf67NWcDYdsadY4dhmzwiY3O3segmBJaTcduTK:Sznn7zEWcDd+sllhJaTssK

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      skystealer-main/builder/main.py

    • Size

      1KB

    • MD5

      d1cbf053305aae47d9b01d1475f78510

    • SHA1

      2b30bd4b41fce3581515d420b38fb69de1af7dd8

    • SHA256

      168aa0e72df036ec02b8c6597eb8a7d59163f244e5cb3df623af68852210d413

    • SHA512

      7de74bc218fbafc321b7ef3226266c1f1ce0c8c832ab34c25e4585ae1af9a6e68dd51aa2e94194f853607383c7ac7f78774a524ebc6762955b4c84060d09604e

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      skystealer-main/builder/util/build.py

    • Size

      2KB

    • MD5

      b972c3bd98189fef3649132428a6b5d5

    • SHA1

      2f9a0e3bb364be7614062a716e97065df9d091c3

    • SHA256

      ae2d7a498db4f1ea8d4cf1f71a9a60e0379a8b6e287d2c8b7cd2262f45b2d88c

    • SHA512

      b9e9281168c684a8136f299e50293d2d0c0fc92c70ee482a7ed27f1340627c628c0347ab36ee33c72ace95595d2111ee103fbb1ead1e0dbe55a3e85dd2f644f8

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      skystealer-main/builder/util/config.py

    • Size

      2KB

    • MD5

      083bc8cc27286e50c08f0f53876f48a8

    • SHA1

      2a1d0ade3e5b4abba267b9ccfeb2fee681a7f032

    • SHA256

      b5f7ff2bfd9a7fc444076ac74dc7034d9d366152f4fb288eab481597bbf54672

    • SHA512

      832bff211d5fff703c1cfe5b54777e5707c4e9703499edfdaa25865bacb7504bdfe41814033e6269537d692e0c53ee58f6c80184697564adf6969931370f50ca

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      skystealer-main/builder/util/makeenv.py

    • Size

      616B

    • MD5

      9636255856ad526bbc00457b24373c54

    • SHA1

      6fba0fb49e9698f9e8a818dcd02f236f4b07a428

    • SHA256

      210579537257392e13074d978b255c0e2313d9bd089c6e6635adbc0109a90789

    • SHA512

      d29b68a830bbe0e8190243df51a88e883da75cacd5b9824ec98f63c34e07582b49d5281ee89569d00520b0e567eaeccefef60e223cde8de2b06a29ac710b23d9

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      skystealer-main/builder/util/obfuscate.py

    • Size

      1KB

    • MD5

      b5854b3148f23dbb9355d3a30e3315a8

    • SHA1

      e4273fcdd3948fa75960af037bc9a916705c553c

    • SHA256

      c9091f59845b3201e05e4294dd14c54ba77ba3e679998fb4b37ea204544a4650

    • SHA512

      1179ac8391e9ec93c23704eaf3c630ce6fcd3dff5d372449addb7639e4bebb05328b1213b32ce99b37b0ec046b23488d9e0073b7de3129005c57d0056d49b126

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      skystealer-main/builder/util/writeconfig.py

    • Size

      555B

    • MD5

      2b14c9284e5337eb2af6359827b523e9

    • SHA1

      74f35cae83f8830c181240d945c94c162160c331

    • SHA256

      eb1007f66f1c665f2a05156e78df47b7386736c9cdc272dbcc114ab3291029f7

    • SHA512

      264399eb65d810e47bdd85a4cea943ab06937f44cf6510b71f4202cc745d49b3087b369a64d34e9db5e16365defbfd8a45336b0fbd0dba1d3e1972093be94dec

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      skystealer-main/main.exe

    • Size

      17.6MB

    • MD5

      4edced436524b16a1f5eaeaf7d182346

    • SHA1

      e2626eacc78d6573d7696407f0de1db5be040135

    • SHA256

      a0c2878314622706025c60f880d11c7af08b2900e9603d580d9cfd6544599d71

    • SHA512

      45b26f06998c2085c14c2d2825b540458be65916a869d77eb360228ceacc7ae303f3ad581075d8c046640c5093102a2c31b91692f69fd5af2fd4f753c22c4ded

    • SSDEEP

      393216:DqPnLFXlr8gQpDOETgsvfG9wagqKvECk6C1uAL9q:GPLFXNlQoEM1jaC1u2o

    Score
    7/10
    upxdiscoverypersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14

    • Target

      skystealer-main/src/components/antidebug.py

    • Size

      11KB

    • MD5

      47ae6ac6b52d97d6b952b140e82ff9cf

    • SHA1

      eebba9b7e4dd198d4050e597bab281b87d5785da

    • SHA256

      92e1b4427e17cc7ffcce8f62a3bba16455110086314577fa76ba87804dc6803c

    • SHA512

      97bba85c42ba15f48f2c21843bbccc4af7a3b08bd93d44db5361458900c9e3a3d0607cff38e7b078883ffc6d8fad0dcb9a422015f1165442bd7ddeaa32707e5a

    • SSDEEP

      192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/K/m:0ZTd+nJYJzrn+rgeeWaOJjd5vpVCH

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      skystealer-main/src/components/discordtoken.py

    • Size

      17KB

    • MD5

      91d7fa95e5af17a5132378a15d855d01

    • SHA1

      86b8f0e7a87bf913874f9d4d1e823581c6020e5e

    • SHA256

      272e576f88e24667b784c1d8f08fcde3ebb13a126e216f1ab25a49b3fa1b6eb1

    • SHA512

      0a22a3738ab6d60ab143ba6fd34755dd5e501b55f10a72c731672c9ee3a564e4dc7ab070d7f9ae4d1f3abd5d544ba723cd629e14dded7103ab323a7301a582c6

    • SSDEEP

      384:Cg9WPIDbhMUN7ir4hq4hM6vPhQ6pn3hRJPuEbq7rqLmBvS6:YIz704g4a6Xh5pn3hRrbcr8UK6

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      skystealer-main/src/components/injection.py

    • Size

      2KB

    • MD5

      deaf00b5fa1e87d383d67653e7f9e632

    • SHA1

      615abf76bcfbaf3249e65f5d764cbc8a9c457317

    • SHA256

      9933b323c85c9bf087367660bacf9e5bf46c5e869688af46922560c9b710d9da

    • SHA512

      255fc671802131cfa7bc498a0877116db35fd5b6380b630ccfda37f282956d8a1a6f65dd5414e84659970fa7f461c45ab1b7dedabef8f11beca2f121f8260e8a

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      skystealer-main/src/components/startup.py

    • Size

      1KB

    • MD5

      0fede8d83b25bf76cb24df5fafc68bbe

    • SHA1

      3074408484a65ce9e72bd4b9ad6dc774029031f1

    • SHA256

      1c4fb55c0625e037d90c52a47b7dc46f4fd7c400464834e22e6871e00176dc5e

    • SHA512

      74b01d93691bfe176ba6f6d3e8e0827fa4b520c044f05289ee20ee8712eb59f1c13e1b69bed45884fe748366fb28d2000e2d8cafd45512dc9cc932ddec8b6cdc

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      skystealer-main/src/components/systeminfo.py

    • Size

      6KB

    • MD5

      dacc6629a93a629f2e5e8dd6e6ac8752

    • SHA1

      f0b8436cf7d2e9fcc3d84da50955b82b9817eef4

    • SHA256

      e4aa53a74dbe1a23ddd6b678ef982cb1ce680e50385dba761f5e4971944abf8d

    • SHA512

      5ba2c0a24cb45f306bcc5d91be69f5e2ca90bccae0988874491a5e6018858e0a90f5c5b292365f6662c2f812d156e8dac71297afe395ec813a28a75c577c7e2a

    • SSDEEP

      96:o62a5Q8kjqXmBHyCOMHdpvlGa4sVV2iHhhrqZb+zadcTP9eTnSIf:PQRyGTka/T2oOZazaaL9erj

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      skystealer-main/src/config.py

    • Size

      192B

    • MD5

      36b6f6034baef719be778b89b1226a6e

    • SHA1

      f02c63ff4ead4a66e375ae8145d409537b302d78

    • SHA256

      70773b420265012d9e1cb9d9bc8a83d8a4ec055d3907bd85102cce4a1853abac

    • SHA512

      67e3164601de145a4ee2888a1772aa8a12cfcc8a2edc995861fd316ab187d9ae3cb0ee36a9094fdb79db8c5d907f50b9dfe88828590285f02c7fd65b5cb6e129

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      skystealer-main/src/main.py

    • Size

      1KB

    • MD5

      db5386b5f9edfc7500d0508fc49a9a59

    • SHA1

      4c79b803e2090d86dd38c7671b1a9b5322b3cf3a

    • SHA256

      ddfbeb221f72eaa4c8e2e4dcdf604307dcfd0d9168c0837a10110cd809f82060

    • SHA512

      a5c6435242930285e41e98e7284fdb0708f654b849e697bd10e8ad12631d5e83e647b775a1bf6d61b9a2958d4969c475055ff3071affcefceed3234b92d69634

    Score
    3/10
    discovery
    behavioral27behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

pyinstallerempyrean
Score
10/10

behavioral1

discovery
Score
3/10

behavioral2

Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

Score
3/10

behavioral13

upx
Score
7/10

behavioral14

discoverypersistenceprivilege_escalationspywarestealerupx
Score
7/10

behavioral15

discovery
Score
3/10

behavioral16

Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

Score
3/10