General

  • Target

    main.exe

  • Size

    20.8MB

  • Sample

    250102-vvgv3sskgm

  • MD5

    6915d905325f953bc6cd69b7c6d6144b

  • SHA1

    6073bee0ea580254a1d42c33948408c6ba6e4524

  • SHA256

    540c41acad1939ed9e618f58945d71bb71445397835fbaa633e11aaed7fc520f

  • SHA512

    b220f4cdd356781556c6e27ae9f74f6a275224849c447e23019cfad5b64d087a3f0aa6f1d44f90187f7cb7c912551f84c4ef5d2186a5258475b9168ca5ca699c

  • SSDEEP

    393216:VqPnLFXlr4o7n0jcwQ8DOETgsvfGF5KghSkVZvE4+x1VTgpJzYm:MPLFXNricwQhEfILwbTgpf

Malware Config

Targets

    • Target

      main.exe

    • Size

      20.8MB

    • MD5

      6915d905325f953bc6cd69b7c6d6144b

    • SHA1

      6073bee0ea580254a1d42c33948408c6ba6e4524

    • SHA256

      540c41acad1939ed9e618f58945d71bb71445397835fbaa633e11aaed7fc520f

    • SHA512

      b220f4cdd356781556c6e27ae9f74f6a275224849c447e23019cfad5b64d087a3f0aa6f1d44f90187f7cb7c912551f84c4ef5d2186a5258475b9168ca5ca699c

    • SSDEEP

      393216:VqPnLFXlr4o7n0jcwQ8DOETgsvfGF5KghSkVZvE4+x1VTgpJzYm:MPLFXNricwQhEfILwbTgpf

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      main.pyc

    • Size

      7KB

    • MD5

      2a2cc8b7094088053766519550d081df

    • SHA1

      9069f34d45add577524fe5a6bc8b5c5703d7c7d0

    • SHA256

      3326352af9df5c2113ca49913b8d859151632b1c94a95724ed361dcefedcbe68

    • SHA512

      15b7f729b76f64a14b379b8818b45241f75723adf4206b29d0090a8fd9cf506daa100bcc6920ac7fbb213f4d29e226d5d3b38a3a9a352cbc4ff8be1f9aea094b

    • SSDEEP

      192:wcaOaXWF2QvVYD8fJWdXw4NlnM9nlJhwqVpbMdwJ3nnw:QOyyvpWu4NJwP2klPJXw

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks