General

  • Target

    FireStresser.rar

  • Size

    7.5MB

  • Sample

    241215-m3glaatnel

  • MD5

    ee36b3020cb0a7b231733d2bc0307889

  • SHA1

    42fde2a95eb0aca9e3e875a98a919082269a81ac

  • SHA256

    f2839092a4e2eb8b7a257cfc323d66b63225fa313f6d38f0bdbb23ee7def30f6

  • SHA512

    833afecd02451200894f7b6642219cbb329ae15bb23e80bbc7638895ebb70d1780a393a105b109b0e63c17e97e9f3111efadd5b66cbe493f2335bfde531e7d25

  • SSDEEP

    196608:gqBn1+NuNEw5YDn2H/PohY/iORUWsyAzpdiKf4+xGlGZpi947kBck:douaPz2fPIQiA0OB+oD4Q6k

Malware Config

Targets

    • Target

      FireStresser.exe

    • Size

      7.7MB

    • MD5

      36f33b591041974c13bc6665eef19320

    • SHA1

      4555580ba9c99acf6188865a5ba79746ea1d265a

    • SHA256

      199538ef4c4632fdaf6da1b3c3b3cfa230a1ca69b141baf75131b2afdb2b3cb1

    • SHA512

      2af10e4b382bd8c0606c815fd3bcc547350655e7dc19868d9931e2311e18bba4b10b1f08e9f16b9b478c11979f45b2312f70350745bbb44d2d35d238cd312406

    • SSDEEP

      196608:0y0uJbeNTfm/pf+xk4d6XCLRpmrbW3jmrE:PAy/pWu4cyLRpmrbmyrE

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks