General
-
Target
OperaGXX.exe
-
Size
9.8MB
-
Sample
241208-ty322synfz
-
MD5
e70c39d1f1ac0e52fcc52d64fa871f30
-
SHA1
f17425132831a1ad0a112c75b7a7f04fed73c965
-
SHA256
1ef1e0470f27e25343087cd3ae225d4dd8711a31f308b314b83affe57b3181bb
-
SHA512
50d4e45b23b50b531b6d1db7bbb8683a427b9060df77cd993bd6ef36163f44d882985c3217a4d15fab8e53437582d670da7549778918f5c0d68205b61794fb69
-
SSDEEP
98304:hH6fVmD1C2gnoWoS7Kr7Eg7ru9MvE9pRD4Z4S5bovr:hH31C2bSI7Eg7ySsqBRovr
Behavioral task
behavioral1
Sample
OperaGXX.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
OperaGXX.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
OperaGXX.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
OperaGXX.exe
Resource
win11-20241007-en
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1313142704439427092/YKwWrnk0E-QciBzXVfcEmZg-CAYCUchZuAphpzY_DvCmjRKFsYGLIEowP8dExV6arEe2
Targets
-
-
Target
OperaGXX.exe
-
Size
9.8MB
-
MD5
e70c39d1f1ac0e52fcc52d64fa871f30
-
SHA1
f17425132831a1ad0a112c75b7a7f04fed73c965
-
SHA256
1ef1e0470f27e25343087cd3ae225d4dd8711a31f308b314b83affe57b3181bb
-
SHA512
50d4e45b23b50b531b6d1db7bbb8683a427b9060df77cd993bd6ef36163f44d882985c3217a4d15fab8e53437582d670da7549778918f5c0d68205b61794fb69
-
SSDEEP
98304:hH6fVmD1C2gnoWoS7Kr7Eg7ru9MvE9pRD4Z4S5bovr:hH31C2bSI7Eg7ySsqBRovr
-
Skuld family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4