Overview

overview

10

Static

static

10

spotify-1-...15.exe

windows11-21h2-x64

7

Creal.pyc

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spotify-1-2-3-1115.exe

  • Size

    14.5MB

  • Sample

    250111-xjvznswmdz

  • MD5

    f425b34a16731e463808cd58fdf0b62b

  • SHA1

    f8efb3387e8dc04b1d92c24d4cdfae5600c9b0f5

  • SHA256

    c657f2ff08156284cc46387beec9a87b19c72a0d17a893d252a6ea7c316cdb56

  • SHA512

    7a65d00bb15e29f2b233ea9530121d3051d0b8cf5f26a37090f59bf8054c61b09e38f833228bcca7e7c0d19b22f53455f4a1d0c1d329907ad9206434fe8bf585

  • SSDEEP

    393216:k9Yi2Vlj87d9NdQuslSq9VoWOv+9fSZk16RU8gWLP:k9Yi2Vl8Z9NdQuSTorvSKS0RUtWLP

Score
10/10
crealstealercredential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      spotify-1-2-3-1115.exe

    • Size

      14.5MB

    • MD5

      f425b34a16731e463808cd58fdf0b62b

    • SHA1

      f8efb3387e8dc04b1d92c24d4cdfae5600c9b0f5

    • SHA256

      c657f2ff08156284cc46387beec9a87b19c72a0d17a893d252a6ea7c316cdb56

    • SHA512

      7a65d00bb15e29f2b233ea9530121d3051d0b8cf5f26a37090f59bf8054c61b09e38f833228bcca7e7c0d19b22f53455f4a1d0c1d329907ad9206434fe8bf585

    • SSDEEP

      393216:k9Yi2Vlj87d9NdQuslSq9VoWOv+9fSZk16RU8gWLP:k9Yi2Vl8Z9NdQuSTorvSKS0RUtWLP

    Score
    7/10
    credential_accessdiscoveryspywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1

    • Target

      Creal.pyc

    • Size

      127KB

    • MD5

      a6e99e0628a47836f86759537f2043a5

    • SHA1

      0e558fd7a120b7d1bc5ba79fc44b4d3fc9b7164f

    • SHA256

      f1b64188016265aac7d4c3cd4dc346d240d965b856b0f60bf341e53fcd273450

    • SHA512

      5d5d5f107766954bf93866a760783c54b0cb279569fb741d0116d7133da29a77576dea7373f323d86172aa6c439266924e956ef9492d41652c315592dea6866e

    • SSDEEP

      1536:LuPDrNe3OzTZMB7aK12XmTNlBYmw7zTS+ls2YcGBCnPKUigi5eMeOi6S0Eq+w0cE:yPDhe3Oz0B3Yf/TZqcGBJgip36

    Score
    3/10
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks