General
-
Target
Built.exe
-
Size
7.5MB
-
Sample
250118-shpztaxmfj
-
MD5
72ecef7f3ad67a7347b62f8f315dba58
-
SHA1
a55209c42ae2e205ef98ac6d04dc658b04e5151e
-
SHA256
ca4c698151072be722f3b0a2a2fc26c7237fb2d4d16a6874273609aac3d6552e
-
SHA512
789f81c4b3433d44fc0141a260546a317005595193c6cf5402a589667f4d1d74b221ee7fb82b709a6e9d2ab183c938a7b90a10a2c4238560fb5aeb8b1928b545
-
SSDEEP
196608:eYhhOJpurErvI9pWjg/Qc+4o673pNrabeSyzWtPMYnNcsq:NgpurEUWjZZ4dDLIehzWtPTNzq
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Built.exe
-
Size
7.5MB
-
MD5
72ecef7f3ad67a7347b62f8f315dba58
-
SHA1
a55209c42ae2e205ef98ac6d04dc658b04e5151e
-
SHA256
ca4c698151072be722f3b0a2a2fc26c7237fb2d4d16a6874273609aac3d6552e
-
SHA512
789f81c4b3433d44fc0141a260546a317005595193c6cf5402a589667f4d1d74b221ee7fb82b709a6e9d2ab183c938a7b90a10a2c4238560fb5aeb8b1928b545
-
SSDEEP
196608:eYhhOJpurErvI9pWjg/Qc+4o673pNrabeSyzWtPMYnNcsq:NgpurEUWjZZ4dDLIehzWtPTNzq
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3