Overview

overview

10

Static

static

3

Payment_su...92.exe

windows7-x64

10

Payment_su...92.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sekundres/...ns.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_summary Ref_479292.exe

  • Size

    598KB

  • Sample

    250218-q9xgvssnv5

  • MD5

    d69ecbcadf006ee218a3c6178387fc8b

  • SHA1

    f04e7f8d40e481d70e99947a93160939da708153

  • SHA256

    c24cfb51e48aab3a7e3d993a03f92dc552615911e3086ca980f3e10f54f13525

  • SHA512

    51d110995f39f6f6360a15d3796adeca9f924868b49eab7f52361b3c01b16d89c00ce478c69968bdb7bb71b1917020091dbf0cf16fa4fac41191ecaef75be0f3

  • SSDEEP

    12288:ZfZ6QaYTUyLtOq9qeRxgAl+dLSf9Ogip1uj3/tHXbai1P4dXX:ZIdItOq9qE+dLSfEgibujPtWiR4t

Score
10/10
guloadercollectiondiscoverydownloadermacosspywarestealer

Malware Config

Targets

    • Target

      Payment_summary Ref_479292.exe

    • Size

      598KB

    • MD5

      d69ecbcadf006ee218a3c6178387fc8b

    • SHA1

      f04e7f8d40e481d70e99947a93160939da708153

    • SHA256

      c24cfb51e48aab3a7e3d993a03f92dc552615911e3086ca980f3e10f54f13525

    • SHA512

      51d110995f39f6f6360a15d3796adeca9f924868b49eab7f52361b3c01b16d89c00ce478c69968bdb7bb71b1917020091dbf0cf16fa4fac41191ecaef75be0f3

    • SSDEEP

      12288:ZfZ6QaYTUyLtOq9qeRxgAl+dLSf9Ogip1uj3/tHXbai1P4dXX:ZIdItOq9qE+dLSfEgibujPtWiR4t

    Score
    10/10
    guloadercollectiondiscoverydownloaderspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Sekundres/undervisningsformens.app

    • Size

      219KB

    • MD5

      2a79ab217485962274353ed00ad54303

    • SHA1

      5e8f0763b521c8b263fdaff95c303a472a1775cf

    • SHA256

      2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a

    • SHA512

      7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e

    • SSDEEP

      768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN

    Score
    1/10
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks