Overview

overview

10

Static

static

10

AQUA PREMIUM (1).rar

windows7-x64

7

AQUA PREMIUM (1).rar

windows10-2004-x64

1

AQUA PREMI...of.exe

windows7-x64

7

AQUA PREMI...of.exe

windows10-2004-x64

8

��M̵L�.pyc

windows7-x64

��M̵L�.pyc

windows10-2004-x64

Respoof.cmd

windows7-x64

1

Respoof.cmd

windows10-2004-x64

1

first.reg

windows7-x64

1

first.reg

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AQUA PREMIUM (1).rar

  • Size

    5.8MB

  • Sample

    241224-kz3y1atman

  • MD5

    f71e4dec9ba49a0996f577257ec31ed8

  • SHA1

    55c9af15d1c9e55f8966d819a623b225fd06f5cc

  • SHA256

    05266a1e82541f3908c2acdb6596791f842c4f483546e89cd52c22bb67a3f0f5

  • SHA512

    113ff3f29821ea93c71dd32854714caf8efec9ea6f6e78f39254f44358bf6cfab40984d6c72e4951156c03233bbac0a6de748e94459d3ac5ddc91cbb875c9ec7

  • SSDEEP

    98304:WoJ7oTgg90I9kbDh3D6cRxeqmN06/JGq46iZ1XNSNxCIH8GYwCudG8pUT0u/:Wopozd9ADpDWNeAJHADSrMw5ju/

Score
10/10
blankgrabbercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      AQUA PREMIUM (1).rar

    • Size

      5.8MB

    • MD5

      f71e4dec9ba49a0996f577257ec31ed8

    • SHA1

      55c9af15d1c9e55f8966d819a623b225fd06f5cc

    • SHA256

      05266a1e82541f3908c2acdb6596791f842c4f483546e89cd52c22bb67a3f0f5

    • SHA512

      113ff3f29821ea93c71dd32854714caf8efec9ea6f6e78f39254f44358bf6cfab40984d6c72e4951156c03233bbac0a6de748e94459d3ac5ddc91cbb875c9ec7

    • SSDEEP

      98304:WoJ7oTgg90I9kbDh3D6cRxeqmN06/JGq46iZ1XNSNxCIH8GYwCudG8pUT0u/:Wopozd9ADpDWNeAJHADSrMw5ju/

    Score
    7/10
    upx

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      AQUA PREMIUM Spoof.exe

    • Size

      5.9MB

    • MD5

      47911cfecd3dcd8b505235dd9b187992

    • SHA1

      9c874cead1208b3b77f0ae535d07522629e6e676

    • SHA256

      3aac1ef0cd3825fbb753199f1fe31430f4aba354cc4fb8e7db74b63ac8f7efdf

    • SHA512

      cac06ffeb06e83c2e0a4c98512dde8292c2800a35a4653621e6cdd2877293381ebf7f773456974b4181838e98916ff9a6c6d5ec2ec145398cfddbb2668889eec

    • SSDEEP

      98304:V2De7pzWqe8MMhJMjarCtaCObO/OH9KkqQz4W1kgeDtFMai3lMmg8N:VzNzWKB6yA+KO0WR4iarmg8N

    Score
    8/10
    upxcollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      ��M̵L�.pyc

    • Size

      857B

    • MD5

      e7a8bc78dc6ec3f0e7ddb9cc483cc9c7

    • SHA1

      1fe74f2f901d11ad069e206aec341f373cd5ca68

    • SHA256

      d2000ea06472c5f500276f5b188b4afc99b64ce6bb2a459e2ed1855eafd7e1ce

    • SHA512

      cda63d07f7801233ed0ff66e6d52445b152a6dac976f16c411e8cf9a6834a44a62e0c43566d96c15540da17a5c1d5b559e8fb382d15f927802f6c5c3e9437c22

    Score
    1/10
    behavioral5behavioral6

    • Target

      Respoof.cmd

    • Size

      65B

    • MD5

      a64d3a4c1d61344273de4e3f2dd3b652

    • SHA1

      245859a286db226f15a0c8c51c9b71f31ea1b79a

    • SHA256

      6f4b8912c0f77f2e589e8fed98246680bdd01a442f91729ce15ee812b8f4d50e

    • SHA512

      e564799596d11b71590569f8c7b31fe7446cabc2dc6bc423308edf7ad2fcb74cbc621891cc594a6b2ebc8320600d0ca2530e92042477246914c55f369d2856cb

    Score
    1/10
    behavioral7behavioral8

    • Target

      first.reg

    • Size

      180B

    • MD5

      a8d8e8a3e08f69287db1ac4b22722264

    • SHA1

      d28720d9d369b6c3fab3d035cc7508f5797bc0b3

    • SHA256

      626e406859c1f1e1ed6519faeb0e8d3f48507c5d204d7736d1d33c894cf1ae66

    • SHA512

      caae2df1b4e88e0978d658df7221d1af47050f10596ac393281e06c84295097b79ce33b3d5cd6c4f9b5fcba009992ea3cb3891a4ce1cf3a768f612ed12ea0d31

    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks