General

  • Target

    Mozilla Firefox.zip

  • Size

    104.9MB

  • MD5

    652262cea813d8125fc12fdd6ac4afd1

  • SHA1

    875109352bfda6dbaac4f8e8076dbd8ee849637b

  • SHA256

    656eb4d10487e855a11b88e487b887e88f8d3540f14c6a08869e83f8c2d5e13f

  • SHA512

    ff9d9d65b4daf8bb7bc0de19062b9f0dd4384459e8cf48c3eac3c6f13857289076d5d0da92eda566e0971129228d366ecff5bcbd4e916e66fa2ef1fa40b5ecc5

  • SSDEEP

    3145728:yc056vnwWDJcI9W6Mnm+pdLF4E/7qNBmss0uTKg:ycq6vnrlnWxNqd42uZ

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Blankgrabber family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Mozilla Firefox.zip
    .zip
  • Mozilla Firefox/AccessibleMarshal.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    c0caa654a8ff511450dc30146e927410


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/application.ini
  • Mozilla Firefox/browser/VisualElements/PrivateBrowsing_150.png
    .png
  • Mozilla Firefox/browser/VisualElements/PrivateBrowsing_70.png
    .png
  • Mozilla Firefox/browser/VisualElements/VisualElements_150.png
    .png
  • Mozilla Firefox/browser/VisualElements/VisualElements_70.png
    .png
  • Mozilla Firefox/browser/features/[email protected]
    .zip .js polyglot
  • Mozilla Firefox/browser/features/[email protected]
    .zip .js polyglot
  • Mozilla Firefox/browser/features/[email protected]
    .zip .js polyglot
  • Mozilla Firefox/browser/features/[email protected]
    .zip .js polyglot
  • Mozilla Firefox/browser/features/[email protected]
    .js
  • Mozilla Firefox/browser/omni.ja
  • Mozilla Firefox/configuration/configurations.bin
  • Mozilla Firefox/crashreporter.exe
    .exe windows:6 windows x64 arch:x64

    e632f4830deeaf9142a2993c93e45675


    Code Sign

    Headers

    Imports

    Sections

  • Mozilla Firefox/default-browser-agent.exe
    .exe windows:10 windows x64 arch:x64

    c291c424ba221f1fb0566fcef2405b5a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/defaults/pref/channel-prefs.js
  • Mozilla Firefox/dependentlibs.list
  • Mozilla Firefox/firefox.VisualElementsManifest.xml
  • Mozilla Firefox/firefox.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Code Sign

    Headers

    Imports

    Sections

  • �ZQ���^.pyc
  • Mozilla Firefox/firefox.exe.sig
  • Mozilla Firefox/fonts/TwemojiMozilla.ttf
  • Mozilla Firefox/freebl3.dll
    .dll windows:10 windows x64 arch:x64

    a2535afe3971a088ec9e65d2f3a58099


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/gkcodecs.dll
    .dll windows:10 windows x64 arch:x64

    2c49cdfd25141aefad04854eb8cfdfab


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/gmp-clearkey/0.1/clearkey.dll
    .dll windows:10 windows x64 arch:x64

    e382b1b04d2730dfb0b17af6b86c7149


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/gmp-clearkey/0.1/clearkey.dll.sig
  • Mozilla Firefox/gmp-clearkey/0.1/manifest.json
  • Mozilla Firefox/install.log
  • Mozilla Firefox/installation_telemetry.json
  • Mozilla Firefox/ipcclientcerts.dll
    .dll windows:10 windows x64 arch:x64

    30fe3932e4ff3c7dab2ee280ae059c16


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/lgpllibs.dll
    .dll windows:10 windows x64 arch:x64

    9d904cdbca8645054829eb99a7afc57f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/libEGL.dll
    .dll windows:10 windows x64 arch:x64

    661a4dda43f07112eea7988811f67e79


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/libGLESv2.dll
    .dll windows:10 windows x64 arch:x64

    04c97c93b0f82d44f85bbe1d0611feb3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/maintenanceservice.exe
    .exe windows:10 windows x64 arch:x64

    deac793c737c6715eac9d34cc38e44a1


    Code Sign

    Headers

    Imports

    Sections

  • Mozilla Firefox/maintenanceservice_installer.exe
    .exe windows:4 windows x86 arch:x86

    6e7f9a29f2c85394521a08b9f31f6275


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe.nsis
  • Mozilla Firefox/misc/Injector.exe
    .exe windows:6 windows x64 arch:x64

    874ca5501ac4152a0b735eef5b4eb378


    Headers

    Imports

    Sections

  • Mozilla Firefox/misc/Module.dll
    .dll windows:6 windows x64 arch:x64

    d066c569743a0cab9e5c4060d891248e


    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/misc/log.txt
  • Mozilla Firefox/mozavcodec.dll
    .dll windows:10 windows x64 arch:x64

    57e453e44bae0cabab6dad752b62fa19


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/mozavutil.dll
    .dll windows:10 windows x64 arch:x64

    53b87600a74d7727ef894ebbb8c6e44b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/mozglue.dll
    .dll windows:10 windows x64 arch:x64

    797a787cbdf79b2ae5be81532af252e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/mozwer.dll
    .dll windows:10 windows x64 arch:x64

    f640e72900950788d242839c56c20663


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    118dde577a38119350ab495f68a0326f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/nmhproxy.exe
    .exe windows:6 windows x64 arch:x64

    a5cc79c72237e4d3ea13ea50f0c6199a


    Code Sign

    Headers

    Imports

    Sections

  • Mozilla Firefox/notificationserver.dll
    .dll windows:10 windows x64 arch:x64

    603163895bc4d56a39107a50011d67c7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/nss3.dll
    .dll windows:10 windows x64 arch:x64

    a4305e5606c02d96e94e41bb036d7312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/nssckbi.dll
    .dll windows:10 windows x64 arch:x64

    826207b3a1a9c050f59c7b3d681b1199


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/omni.ja
  • Mozilla Firefox/osclientcerts.dll
    .dll windows:10 windows x64 arch:x64

    e88ed0946302194ac3e0073071b40be2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/pingsender.exe
    .exe windows:10 windows x64 arch:x64

    c199bc60d38108a1744b5ff4625d24c6


    Code Sign

    Headers

    Imports

    Sections

  • Mozilla Firefox/platform.ini
  • Mozilla Firefox/plugin-container.exe
    .exe windows:10 windows x64 arch:x64

    25fdffb9a85962a0f34bcd8fa6ec268b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/plugin-container.exe.sig
  • Mozilla Firefox/postSigningData
  • Mozilla Firefox/precomplete
  • Mozilla Firefox/private_browsing.VisualElementsManifest.xml
  • Mozilla Firefox/private_browsing.exe
    .exe windows:10 windows x64 arch:x64

    e575f37fbcf305a828176ba505fd3472


    Code Sign

    Headers

    Imports

    Sections

  • Mozilla Firefox/removed-files
  • Mozilla Firefox/softokn3.dll
    .dll windows:10 windows x64 arch:x64

    e6ec78f94831f7c2f64fae817833bed1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/uninstall/helper.exe
    .exe windows:4 windows x86 arch:x86

    6e7f9a29f2c85394521a08b9f31f6275


    Code Sign

    Headers

    Imports

    Sections

  • $EXEDIR/uninstaller.exe.nsis
  • $PLUGINSDIR/AccessControl.dll
    .dll windows:4 windows x86 arch:x86

    4f9ac94e28e29febec2ab9514477dad2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/AppAssocReg.dll
    .dll windows:4 windows x86 arch:x86

    3c290133e6ebf9207ee785f8308f1159


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ApplicationID.dll
    .dll windows:5 windows x86 arch:x86

    342181dc22e6d047b283267c677abe77


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/CityHash.dll
    .dll windows:4 windows x86 arch:x86

    720db9870d7edf191c6f2f6cfa752e0e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InvokeShellVerb.dll
    .dll windows:4 windows x86 arch:x86

    6e69df65bd2a5bb187e054e6154f54c2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/PinToTaskbar.dll
    .dll windows:6 windows x86 arch:x86

    d4e6fc485e509e0a70d51be16c2e6a49


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ServicesHelper.dll
    .dll windows:4 windows x86 arch:x86

    afbd910e6d158852afdd55b56e0d10fe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:5 windows x86 arch:x86

    45fa690faed482cb9bfd08458ed442ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    2a2e0e82c0dc9890f9201e8bd8ecbff2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    5e62e8e248e7364886b604bd1fcf4c13


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/liteFirewallW.dll
    .dll windows:5 windows x86 arch:x86

    d581909bbb46b6bf2b16e48b9e3dd1d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c1c7505e1e6e929ebb6b9100e55b050a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/uninstall/shortcuts_log.ini
  • Mozilla Firefox/uninstall/uninstall.log
  • Mozilla Firefox/update-settings.ini
  • Mozilla Firefox/updater.exe
    .exe windows:10 windows x64 arch:x64

    49b1296267bd0a61266596c75988709d


    Code Sign

    Headers

    Imports

    Sections

  • Mozilla Firefox/updater.ini
  • Mozilla Firefox/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    7f07fd94e5bb907093556781cc464017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    72707e942878aac770fcc118ce3ec1c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/wmfclearkey.dll
    .dll windows:10 windows x64 arch:x64

    129c57c34b55e905f7b9955477756cef


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/xul.dll
    .dll windows:10 windows x64 arch:x64

    7e45756df27a8299a3d2af356edf5450


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mozilla Firefox/xul.dll.sig