Overview

overview

10

Static

static

1

b28723506b...4e.msi

windows7-x64

10

b28723506b...4e.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b28723506b2dbc59052de0b64258a34e.msi

  • Size

    1.9MB

  • Sample

    250307-tlajzatk17

  • MD5

    b28723506b2dbc59052de0b64258a34e

  • SHA1

    adb829bc97158ee2a07aceece39423b16ee87c0c

  • SHA256

    9b9a83b5b88d7b361e4b48d9e15b9edb43e36a059bc4dbd871053cf108e6ff73

  • SHA512

    32aabf3381cf7ebbd44b9f7f34ca320b721967b412b2e6084e70e5cf0ab41a6b481182b83fdea79c3a77026efc43995ae269353c0b3608d6206218ea516df700

  • SSDEEP

    24576:Nt9cpVDhe6I6r31VcwEKk0w/cH8DfeE14:CpRhnPr31VcwcXzv

Score
10/10
metastealerdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

metastealer

C2

kagkimuoakomksww.xyz

cwikwiiisuyqymso.xyz

qgimwqowkmuicoos.xyz

kuueskmwqmwoocuq.xyz

eaeueussigokssqg.xyz

eoyqkgcyoesysssk.xyz

ocmmqamiyucswwik.xyz

eimemucysaammomg.xyz

iwomsoekyisuymws.xyz

mqykiccmwokeumes.xyz

iqqcgqqseysecuum.xyz

iqmoyikmqymsmcwm.xyz

aseuqoqgaueaymyo.xyz

wycuamkomemmigmy.xyz

ceiyeqaoscmsamim.xyz

skcqkaykccckqyam.xyz

kaycmqwocuyyuqyg.xyz

mqssyaeoeeucegqy.xyz

ywqamawcqumaqiyq.xyz

skscsegicyqikqww.xyz
Attributes
  • dga_seed

    12914

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Targets

    • Target

      b28723506b2dbc59052de0b64258a34e.msi

    • Size

      1.9MB

    • MD5

      b28723506b2dbc59052de0b64258a34e

    • SHA1

      adb829bc97158ee2a07aceece39423b16ee87c0c

    • SHA256

      9b9a83b5b88d7b361e4b48d9e15b9edb43e36a059bc4dbd871053cf108e6ff73

    • SHA512

      32aabf3381cf7ebbd44b9f7f34ca320b721967b412b2e6084e70e5cf0ab41a6b481182b83fdea79c3a77026efc43995ae269353c0b3608d6206218ea516df700

    • SSDEEP

      24576:Nt9cpVDhe6I6r31VcwEKk0w/cH8DfeE14:CpRhnPr31VcwcXzv

    Score
    10/10
    metastealerdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Meta Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

      stealermetastealer

    • MetaStealer payload

    • Metastealer family

      metastealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Privilege Escalation

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Defense Evasion

File and Directory Permissions Modification

1
T1222

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.