Overview

overview

10

Static

static

3

689cf9d727...b5.exe

windows7-x64

10

689cf9d727...b5.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Smaamnten/...ns.app

macos-10.15-amd64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    689cf9d72781c2f6088289d743356a993459f11cd22a01446f3a065a1cc8b7b5.exe

  • Size

    664KB

  • Sample

    250221-drtl2atlz9

  • MD5

    b8f3253be81ad12d8fa2fdb5c5b158ac

  • SHA1

    c2f0a6659f0ea8d2a1be43dced1a792717b22cec

  • SHA256

    689cf9d72781c2f6088289d743356a993459f11cd22a01446f3a065a1cc8b7b5

  • SHA512

    2312f670ed0e9e4a8c676b4dcaea2ec0e7c7bf66fc372f2add2080ee266987f0096cb955b73756032bc79196c611d90fc93231037bd1e4d0a28cc86ef42c5353

  • SSDEEP

    12288:ZfZ6QaYTUyLtbjIJOC4HU4H9Sd4JzDEvJRVsTUBgD+1AFneLtHXbai1P4dX1:ZIdIt3IkaCSmzDg2UBgD+gneLtWiR4P

Score
10/10
guloadercollectiondefense_evasiondiscoverydownloadermacosspywarestealer

Malware Config

Targets

    • Target

      689cf9d72781c2f6088289d743356a993459f11cd22a01446f3a065a1cc8b7b5.exe

    • Size

      664KB

    • MD5

      b8f3253be81ad12d8fa2fdb5c5b158ac

    • SHA1

      c2f0a6659f0ea8d2a1be43dced1a792717b22cec

    • SHA256

      689cf9d72781c2f6088289d743356a993459f11cd22a01446f3a065a1cc8b7b5

    • SHA512

      2312f670ed0e9e4a8c676b4dcaea2ec0e7c7bf66fc372f2add2080ee266987f0096cb955b73756032bc79196c611d90fc93231037bd1e4d0a28cc86ef42c5353

    • SSDEEP

      12288:ZfZ6QaYTUyLtbjIJOC4HU4H9Sd4JzDEvJRVsTUBgD+1AFneLtHXbai1P4dX1:ZIdIt3IkaCSmzDg2UBgD+gneLtWiR4P

    Score
    10/10
    guloadercollectiondiscoverydownloaderspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Smaamnten/Anisbolsjers/Bovarist/undervisningsformens.app

    • Size

      219KB

    • MD5

      2a79ab217485962274353ed00ad54303

    • SHA1

      5e8f0763b521c8b263fdaff95c303a472a1775cf

    • SHA256

      2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a

    • SHA512

      7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e

    • SSDEEP

      768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN

    Score
    4/10
    defense_evasion
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks