d64daff8bacd3501d6704d8d88f5fb348658b1133840cd27623d1ca8951b4224

Sharing

Copy URL Twitter E-mail

General

Target
i№st@113R ver.4.8__P@$$ 0082.rar
Size 8.5MB
Sample250417-fa6w5sspy8
SHA256 d64daff8bacd3501d6704d8d88f5fb348658b1133840cd27623d1ca8951b4224
MD5 a2366169cd6871ba02d8aedff206f4ce
SHA1 87f631cfe1f3e10af6dbafa92e7c1cc0de25d2e8
SHA512 e3bbe67f0f3ee3e1d72bfde3fa0f7b0ce060fb59bf137b0ffb6ae930b6083b25b3607fee4d1b965da199418d1ae300ab4712a798e0b1895c18e4098b04f1ae90
SSDEEP 196608:QtMWq3Rn0+wbg1HBhf35n7UGVi/OEpH30MbPyz02yhGtV:Qto3R4mHBhP1pi/OEd30MbPo02YYV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 700.0MB
- SHA256 5d227742e3c06d911bbe0210e09a863922382e62cfdad98243a906c44d8e6e11
- MD5 f49fc27e5e55fbe6ceae64bfa0d48bf1
- SHA1 14d379c6e9a82096e4764d697e21a49f4158724f
- SHA512 77a8c760e2fd8d46247ae67afbb94f5efa1f52ca18d97332f8da98a0b99d57a5b14840a7ef064ca80fc2796c394733fde9838b7bd7a76b025f7d3109d8943c27
- SSDEEP 12288:X0azTBfj34N6UqwrfVOB/FxvNuFHTGq6ua0S9TN32PlMmTO7oCJW:X0azTdjo0zwiz2Haq6zNN32LyJW
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  ProspectivePremier/Clause.xlm
- Size 18KB
- SHA256 7c052c57e46dd7c0efb3d40964d9fe6f32d3b216de001420528546863c57d58e
- MD5 76ea05f976fe8564cd4b60cf208a0077
- SHA1 02c454a7961abff801313d6d92f0c25b1acbd04e
- SHA512 95276b334af8a80ebf8d3f38890f9e8d0817e5ba0ef3f38f1470381c4f1ad75d141815f923d9b534b67ef2d53ca2c515b39b3f7ef6c78b7323730d5f5126be2f
- SSDEEP 384:7xhYKFNjLAhF+yY4S8T0SpbnPWQu4gyNETQCf0dyknvsvpaUdGOWnI3C0eqmSE7f:7xhFFNX3490aaQZgyOIpjSdy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  ProspectivePremier/Necessary.xlm
- Size 171KB
- SHA256 168319f9a3c1f3e1d81311469ed722beb84e818aa53ced962318a1d7bb9e0036
- MD5 ddf1cb1f79b0117faa28c081ef40c991
- SHA1 3adfc54d8d32a55846e6eb1da7248105fbe15d2d
- SHA512 f2021e0fbbbd0a1156703f8ba4805962d735a1dc2adce8b1b5be779d4c040540356a061e82130835335c21c7084a1f7da0ce9d65a380592b7a457fcc47231d82
- SSDEEP 3072:LkRamG6OXNJo6+BWEI0FJmQQaf1Y6zzTwiIvlZiDY1/sMB4UsPLUmQ1E:8aNXNiBTwwBzzMn9MY1UVPL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  libwaheap.dll
- Size 100KB
- SHA256 532fd260954d47eb1364ea4e79f313b56f4b440a17f32519dcedeb7c91276705
- MD5 17b24cd98ab8714abfb1847aab4bcc38
- SHA1 e3c8a2ea624e9e4739e951f27e8fe0748511c420
- SHA512 29ae5c1d51699e1fd11e0c8d14f5d8b0e56dc973b6b39834c1892014d6a512872e8d9331d9553f3c2ff31dac51dc3b7df7d4df0bee3cb76db84d2bbe9af1a29f
- SSDEEP 3072:FsEMdY59enGtW/zc7fKJP5MKEhxnqiHUM:k4iGtAz0fUZch
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  libwalocal.dll
- Size 1.8MB
- SHA256 9f2bfbd4a93bede82d4b5e465660deeffe3291f3e0df7a37c36282317be588d1
- MD5 62d829f91ec96677fbbc4362cf6fb98d
- SHA1 f641fc9376557d0bd15fd5706d367d4bf76f9cca
- SHA512 0acc08eba170495d9b815fdc1137347d60294d0f5ebf8515c5710cc49d9cc20f266710bd1f005fd867880d94a68ea9dcb8d04161652078ebb7bd6283749e789a
- SSDEEP 24576:OpA61jN4OO29EOglBulx1GWkMDIdqPGGKO44ih7YsGpeG78nVXojw0PteL3:GA61jNF9EcibXNh7YTwG78V400leL
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  libwaresource.dll
- Size 4.4MB
- SHA256 73cb1a52cda3ca650d5e6823e5454f76ffab2ce7b69eeeb261df6276006f3d2d
- MD5 a7bcd6caf81ec3885556a8cf8c4add00
- SHA1 b0137bcd506c563e26f41eeac42300332db7c3d2
- SHA512 7e022fb8d15b99e8d5816ea491abe5e12c247c0ca338c87350e9dc499bfbfd8d32bbc76132d176b2b86e215d60a4ff331b8b66ce73275772b5155ad66c2a9c69
- SSDEEP 98304:KbLBJdrVJnctqtJZ9oIaYZ6twBty+1BW5dCV9xgfk9uqUVz:OVJdrVJPF7cLcW5ixgfvqG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  libwavmodapi.dll
- Size 4.6MB
- SHA256 3c3d8d965bd77dee71575465d21a66777f475e9dc096dc74eca7f8c8563a59fb
- MD5 63068466ca1174caf81e4001fd0c59bd
- SHA1 47631e02756a1f21155ed5843f387aeb690d0a1b
- SHA512 11821ebe6c17f24c39fb0301c5563279866c422f19620395cce909ac6729320d9461af3b4c5b44d1b4f39763464c56f375ca99fefea7311dc736c1b6b627ba1d
- SSDEEP 98304:nD8DndGBd22iCbfgldmfDqI2Xsh7JbLFFNQF8yr:nD8DndGfcCr0dmfDqI2Xsh7JmFvr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  x64/ast_printing.phpt
- Size 486B
- SHA256 8004a11455123353be774794d50a323ffae44d58d82c6f707fcc591126b88dcd
- MD5 4552834858a8672c66f93a9254ce5062
- SHA1 dd822ff841f20cc8327c574c49e57e59fe6e86a9
- SHA512 e4a2aaa6c977f060bbdabfe58985ad9e0f255d57713b11ce4cb1754c109bb8bcdafb84044bfb2804f0d1ccfe1117fd8f076d0e9dc842fa07a3b7130d1e5186aa
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  x64/dynamiclinkui.dll
- Size 574KB
- SHA256 0b31c371ca1247a8d5451752d17db277fa3c73a2d85fe0c6ecbb817a3a9a7cc5
- MD5 1e8030aa264522f0d9b4cabd6787807f
- SHA1 55ca1aa6015d34bf668462ecce1eb4a09302165c
- SHA512 f346aeed94be537d8311439ba8ff25d04952e8b3c95d5ccf63d683765dd28a59b18700baf8415e278ab24533f08f83dade102f5d5328c0961943b50226a21a89
- SSDEEP 12288:3YMdyzCI6sNyAB6p9XiD1MgE8LV4ihf2ruV:3YMQzCI6sNyAB6p9Xi5Mg5ppV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  x64/popen_pclose_error.phpt
- Size 633B
- SHA256 627692a36f6c3f4d1365f6a73cf08827320bc5839f1b41c2dddfd7390cd95203
- MD5 59d6a406ff35f73d6947e1a9c1e377ee
- SHA1 e3d7b810d965003012adfe5f68928294434a56dc
- SHA512 ac58be467c2e538f332cbfb403f5956e5d6007e072d6f49ea3d53ef873cc9948e4e67e11aeb663282c3fc06865638074765392b4e4d9b0ac8f2f726d06df4265
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20