General

  • Target

    St--AST.7z

  • Size

    13.6MB

  • Sample

    250704-xvzr1adl4v

  • MD5

    416509d470761075fb21e2035e9607cd

  • SHA1

    b71d19852d2d6b105740adf8c67d7c315dec9136

  • SHA256

    a3d5e253b40cfdb39c025d9b08f036b54436d3637d1b87261a691ee5daf5f83f

  • SHA512

    e87d94ee605fa10a882742971a4874c46951b9bb6810040d9e1010f9d6ad2f56772847634471cef35d09ab428b9cacf9cf251261d841d6dcc4301a72e2ce54a9

  • SSDEEP

    393216:mbFquLF8RvKwDMWrmjUPnnueFZpY2hJ0a8fb8TmT:RoFgUxU2ypBIaziT

Malware Config

Extracted

Family

hijackloader

Attributes
  • directory

    %APPDATA%\shtl

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Targets

    • Target

      Data/Updater.ex

    • Size

      414KB

    • MD5

      a341d9bfaae6a784cb9e2ea49c183fb4

    • SHA1

      d061c12dffa6a725f649dae49c99f157e93bb175

    • SHA256

      52416bb8275988aa5145be6359b6c6a92e3c20817544682c2c1978b50ff2052c

    • SHA512

      9dff4ba2abf889c9f9e71da1f91abdde1742a542b53e8c289e011113e1bcb86d4b1aaf5e7aadf97aa5ed36ab50227295e27ce700d30524f7198fd8f3928c36a2

    • SSDEEP

      3072:bebeJQsqiaJnFdHfQoB9bls1YxRz5QZ1y+ymaQfA30KQBhYJXv4M4Mz07ROZH1pH:jh+nf4+tG/vyohq4M4M4gl7T

    Score
    1/10
    • Target

      Data/d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      b37cc24fcfdcca9dead17a498e66db9c

    • SHA1

      c959ab27ce476dcb0c7312c30c613fe3307bb877

    • SHA256

      9f5b1ad41183ba50896eb09be917b1382980224e212a97080d33c0bf3dee40dd

    • SHA512

      e62e1b985939688aa2eb920f5cfa50377934a8256d7aaa8a1def705de1d47e5cd15515d043622553bbe512469f5c2ed05a7bdedd4f5d17e99109274f9bffe95c

    • SSDEEP

      49152:+CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNZ:tG2QCwmHjnog/pzHAo/Ay

    Score
    1/10
    • Target

      Data/devtools_resources.pak

    • Size

      5.9MB

    • MD5

      731a70d555b49a74607efa43d407948f

    • SHA1

      01b9d0cf34eab6d171a819c0a6a694b8b499702e

    • SHA256

      94b15729530fcf90d11156d38ffd0152ace21182ee44e63c51dc5e2af25345d2

    • SHA512

      4d8eb837ba3ff475f42d72df0375ca4cc0ca18b4e3702ff39e910d67686afb81234c457c61bdd36c8927ff73695bb19017423cda2787242273e0baa398ddabb0

    • SSDEEP

      49152:sLFPZAKkA/koZdvvVqdkTZdvvVqwkF/yWzmJUTvU8ZaTG2os1y3JkkaXSqDJMuXR:WLwW

    Score
    3/10
    • Target

      Data/ffmpeg.dll

    • Size

      2.6MB

    • MD5

      449bf7a46490fa07881d969b6d52c0f1

    • SHA1

      e520a8318e867c7840e6deadef36abcdf2894417

    • SHA256

      5883d041c5f5020ac4b66314d5f89cb6331db3c4ec1c912f72b3ebb9aa8c41e2

    • SHA512

      eabaa33b037ba9f1ee874c534d85ad281985e85e1dd2c115a2693f56381a9a596f22b16938916fd34804a3d490cd0ac53a2969c5f73a923b163c5474fea91b91

    • SSDEEP

      49152:ImBYJtMTl/GuTvOCnCaYXWRTDF8fLen6yfZ0rO43PSGgt2:9OC9YXeTDFWD5PZ

    Score
    1/10
    • Target

      LexActivator.dll

    • Size

      1.0MB

    • MD5

      228df66ab843ac68328e95e255e5fdd7

    • SHA1

      1cb0dfcac1218f5b449921a188485bc069e643de

    • SHA256

      22558eb542191108125d24c6f738108f5d1cedb4203dfc0f04b19740e697ee58

    • SHA512

      07e870f9aff9af885ed0534f6203213904dd8267b668f2d3bf07c959ad11b93aed7ddb749cd8cbe404ff02d13739ba647d9e417b1781c5bdff2ecc9f4b0b5f74

    • SSDEEP

      24576:ful6yLB7qoA8TQVP7sf2WlUqVuvhgHkl6Zj8991W0nw86IUwgOOGyaDmrLxngJgJ:U+zfmv0vSCk4U

    Score
    3/10
    • Target

      MSVCP140.dll

    • Size

      437KB

    • MD5

      05f1b8a11885aa248408597f25ee9d47

    • SHA1

      d73ee3cd3b4a6993f8080211c2d4fdae500cc95d

    • SHA256

      654412a50c83d218d9f72f8bbd0e0d2963ed0b58be59d6661e931f32dc9f80d8

    • SHA512

      676bff631cbb503fe3b538ba34d6eccf3f5260e4325dc966c0fe56ca1c5696f8d2e11b4e652610fb031f066c01bb9112d738464d14ae1dc5ef15dab4d766d77f

    • SSDEEP

      12288:5Cx3l90re/ICEc/pdmFAlG65ndMhUgiW6QR7t5s03Ooc8dHkC2esGd:M390re/ICEIdmFAlZd03Ooc8dHkC2eXd

    Score
    3/10
    • Target

      Setup.exe

    • Size

      5.0MB

    • MD5

      a6a3eb28af006be9d349760bce376184

    • SHA1

      359c88593c67793e3447d71e0b2c710fb707f21a

    • SHA256

      b2f713e1bba1fd2d520e5b41f7a9cdc974602117cc4405419576c833681fb844

    • SHA512

      f65d13f5f341e2717e7d5baab5c1899fc3c235a593ac30503a515f7b0005893b4b1eef9a1706b8cee04976bcf1d4854167a1714c5eae4131f2c62794c25c3d28

    • SSDEEP

      98304:UeA35Slo8NuutsQazvRFn5Aj9Ilb/QdUbRls+GsmfzTSdZbKRySZ:UL35Sy82FzLyj9Ilb/QujKfv+ZkySZ

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

    • Target

      VCRUNTIME140.dll

    • Size

      89KB

    • MD5

      fd82c7b4ee2c40adaae774d7357426d3

    • SHA1

      191b79e6a594bbf1ce17df6610f86d05082b36ca

    • SHA256

      63f98f7eb2b42d4e416d1a0e5631becb5ee6ee09393913b4e0d9b4b852355172

    • SHA512

      0a80d83e4ce3741378df1bd4115cac15f6e18f1bcfe740afdefd958773e252175a0495ff12ba509840e8b8928cdcfa914c4efe864c3375bca4b8bf86d5cd54b0

    • SSDEEP

      1536:uPyFWhPlUYIUwiXKdM5Ri1mGWVYpz4hckJc2rElurnjvHkBGCGE7xRTkfSecb6RM:GOWhPyYIUpJGHlMElurn5Roxbecb6DSh

    Score
    3/10
    • Target

      x64/trading_api64.dll

    • Size

      282KB

    • MD5

      2bca4e2c047ec969cb3cff277e7fc184

    • SHA1

      c4b5b00b605e59c6fdcb6731f2e53069506e287a

    • SHA256

      f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69

    • SHA512

      3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5

    • SSDEEP

      6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x

    Score
    1/10
    • Target

      x86/api-ms-win-core-processthreads-l1-1-1.dll

    • Size

      17KB

    • MD5

      29001f316ccfc800e2246743df9b15b3

    • SHA1

      dc734266648d3463c1f8d88c1ce7d900a4e3b26c

    • SHA256

      e5ea2c21fb225090f7d0db6c6990d67b1558d8e834e86513bc8ba7a43c4e7b36

    • SHA512

      4cffc0c6f94fcd1155909993c622b9103abd7a7bce88742a10abd6a3496a334d667a39bb601f99eb174aa847d7dae056e0d9769754ca86320579b262a20a6599

    • SSDEEP

      384:WRtwDfIe9jWfhWC+Y3DGk8ZpH3GCJErra8o7Q+Y3DGUKn8JN77hhET:ape9A5DGkiRBEXaR70DGa3hqT

    Score
    1/10
    • Target

      x86/api-ms-win-core-profile-l1-1-0.dll

    • Size

      16KB

    • MD5

      6ee66dca31c5cce57740d677c85b4ce7

    • SHA1

      8969db03f98f9548caf8e2d8c7f2f5cd7071f333

    • SHA256

      d00a0edace14715bf79dbd17b715d8a74a2300f0adb1f3fc137edfb7074c9b0a

    • SHA512

      592e3b6c689a0d6c87079c54c3e13e6ee1fc0c5c770abc854040e85464687c46f0a558be22f8759dbc4a100810386ee379ffe4359cf9091d9afae548bc597be2

    • SSDEEP

      384:WiIWfhWx+Y3DGk8ZpH3GCJErcx3l/r7+Y3DGU78JN77hhC6UHR:doDGkiRBEWV/rxDGT3h06UHR

    Score
    1/10
    • Target

      x86/api-ms-win-core-rtlsupport-l1-1-0.dll

    • Size

      17KB

    • MD5

      0069fd29263c0dd90314c48bbce852ef

    • SHA1

      dfb99c850a69e67e85f0a0985659f325bd8f84fc

    • SHA256

      d11093fdc1d5c9213b9b2886ce91db3ded17ef8dae1615a8c7ffbc55b8e3f79b

    • SHA512

      71965e8dd2fd81d0c6dba4dbec8d2d1bfd4a644ef6bba4f6027de4bcdf9c07da16f27f2156c21b52e678c75f0a93a4bcbc3e1942f0a73f1eea5ff64b70662f70

    • SSDEEP

      384:WCGeVxWfhWD+Y3DGk8ZpH3GCJErYtN+Y3DGUO8JN77hhTew:3GeVmyDGkiRBEojDGa3h9ew

    Score
    1/10
    • Target

      x86/api-ms-win-core-string-l1-1-0.dll

    • Size

      17KB

    • MD5

      2e5c29fc652f432b89a1afe187736c4d

    • SHA1

      96f8480b9339411d5d8c94918e983523b1a55c56

    • SHA256

      3807db7acf1b40c797e4d4c14a12c3806346ae56b25e205e600be3e635c18d4f

    • SHA512

      fe1135532e18127f2cfefaaa4a19020d6c790374f648dc93383d58ee52b147d1451af01b8624234bd5d77abe2451eb3e15cbe72a19d283f00cf78c05c43041df

    • SSDEEP

      384:W4yMv9WfhWx+Y3DGk8ZpH3GCJEr4ey/+Y3DGU888JN77hhnY1:DyMvaIDGkiRBEsnDGX3hxY1

    Score
    1/10
    • Target

      x86/api-ms-win-core-synch-l1-1-0.dll

    • Size

      19KB

    • MD5

      979c67ba244e5328a1a2e588ff748e86

    • SHA1

      4c709ce527550eb7534cb6362afdb3623c98254e

    • SHA256

      8bb38a7a59fbaa792b3d5f34f94580429588c8c592929cbd307afd5579762abc

    • SHA512

      49f3c3319aa462b445c6a0b816e10034f6e5a9cf1250ea30b348cfa1ef71525e9f62e2f13253f61375f51fc574847de0d509cffa95103771be356327d5fef90d

    • SSDEEP

      384:Wjdv3V0dfpkXc0vVaCWfhWt+Y3DGk8ZpH3GCJErHZpn+Y3DGUrUN8JN77hhYl:Wdv3VqpkXc0vVabkDGkiRBEtplDGEUq8

    Score
    1/10
    • Target

      x86/api-ms-win-core-synch-l1-2-0.dll

    • Size

      17KB

    • MD5

      659e4febc208545a2e23c0c8b881a30d

    • SHA1

      11b890cc05c1e7c95f59eda4bb8ce8bc12b81591

    • SHA256

      9ac63682e03d55a5d18405d336634af080dd0003b565d12a39d6d71aaa989f48

    • SHA512

      010ab6d3971fabd2a956f891b8d9d20ef487e722443b2882a1a329830dc5c80d262e03a844cd3f5c3e4efcfbad72b9e1fbbf7d9dc6cf85ed034d84726946ce07

    • SSDEEP

      384:WHtZ36WfhW8+Y3DGk8ZpH3GCJEFxMDD+Y3DGEC8q8JN77hhFGT:EbDGkiRBEsJDGS13hj+

    Score
    1/10
    • Target

      x86/api-ms-win-core-sysinfo-l1-1-0.dll

    • Size

      18KB

    • MD5

      cef4b9f680faae322170b961a3421c5b

    • SHA1

      dd89a2d355df989bbd8648789472bfe9c14afcd5

    • SHA256

      1fe918979f1653d63bb713d4716910d192cd09f50017a6ecb4ce026ed6285df9

    • SHA512

      f56617290d4ac25231631d708a6c8b003bdd358bae9672f7dee539a96b292c13e04c65ba5f05937c52f73288eb3dd7cba479ed030942a0d9d3a15512548fa4a9

    • SSDEEP

      384:WBTnWfhWt+Y3DGk8ZpH3GCJEFxqIDh/h+Y3DGER6vJ8JN77hhHWT:0TsIDGkiRBE+IxfDGM6vW3h5WT

    Score
    1/10
    • Target

      x86/api-ms-win-core-timezone-l1-1-0.dll

    • Size

      17KB

    • MD5

      69df2cce4528c9e38d04a461ba1f992b

    • SHA1

      bb1d0da76cf696acf2e0f4e03e6d63fbad4325aa

    • SHA256

      a108a8f20ded00e742a1f818ef00eb425990b6b24a2bcd060dea4d7f06d3f165

    • SHA512

      4d02eecdda0fffc10d5509830079984c7a887b4ca3a80359aa56117b302dcfa594b0710c9f415c823d1674b5c689d31aade44f21750ccd7d53010e67f0b6f0d2

    • SSDEEP

      384:WGOWfhWc+Y3DGk8ZpH3GCJEFxi+3T7Tu+Y3DGEu8JN77hh2KI:5XDGkiRBEm+uDGQ3h7I

    Score
    1/10
    • Target

      x86/api-ms-win-core-util-l1-1-0.dll

    • Size

      17KB

    • MD5

      c6553959aecd5bac01c0673cfdf86b68

    • SHA1

      045585659843f7214c79659a88302996bfb480a2

    • SHA256

      68bd9c086d210eb14e78f00988ba88ceaf9056c8f10746ab024990f8512a2296

    • SHA512

      ae8e42a428202d05fea4f1e6a4d3b919b644a792567f876b0fc392b1cddb856547b4c3b433c002fded6df4d4daec8fb7235f30d1ff9f42943d9e2557ade364d6

    • SSDEEP

      384:WyzWWfhW++Y3DGk8ZpH3GCJErst5+Y3DGU1a8JN77hh8T:35DGkiRBEQpDGw3hKT

    Score
    1/10
    • Target

      x86/api-ms-win-crt-conio-l1-1-0.dll

    • Size

      18KB

    • MD5

      7190cbfad2d7773d3b88ccc25533a651

    • SHA1

      71fe2bacc14b433d51328ea0810c1a030c80d844

    • SHA256

      4aeeae0ac9f6c1b0b8835067ea3b7fc429f353565f18de7858f4ea5d6f72072e

    • SHA512

      b314666c400268bf261c5f9e9966ad0680435241e7a24d85b28ae4405d798b80eedb65ed8db7e8d93df90f886a6719a8b7ace8c25d0429392bc061868890c40c

    • SSDEEP

      384:WL5WfhWO+Y3DGk8ZpH3GCJErBf+Y3DGUCU8JN77hhIw:FVDGkiRBELDGfX3hKw

    Score
    1/10
    • Target

      x86/api-ms-win-crt-convert-l1-1-0.dll

    • Size

      21KB

    • MD5

      3e415147ccd7c712618868bdd7a200cd

    • SHA1

      b332f29915d846519dcb725d39e8c50604d7b414

    • SHA256

      77b69e829bdc26c7b2474be6b8a2382345b2957e23046897e40992a8157a7ba1

    • SHA512

      7e7e50f148414f8a84b4c39d3c7c1e0952f86f95873f3abc25b7f08574bbcce41394a59451868020b178bf68df12615bd356677e8c935c1185c5d07d15e61896

    • SSDEEP

      384:WluyxWfhWK+Y3DGk8ZpH3GCJEFxkNN0O+Y3DGEhy8JN77hhHL:RhDGkiRBEqDGsd3h9L

    Score
    1/10
    • Target

      x86/api-ms-win-crt-environment-l1-1-0.dll

    • Size

      17KB

    • MD5

      ad0cbb9978fcf60d9e9ca45de6a28d30

    • SHA1

      65549d9d7ee72de7d0cc356f92ad22eeb8dc18cc

    • SHA256

      6c9c0dc7b36afe07dfb07dd373fc757ff25df4793e6384d7a6021471a474f0b9

    • SHA512

      aaf4919e7629cd0bcf52283d578214043a4bdf6597a7d808dfcecd5fa1ecbd0b1395c60a165c575d20ca42928500815e14837b9e05530a667c6898e14243d64d

    • SSDEEP

      384:WgWfhWx+Y3DGk8ZpH3GCJEFxHiA6+Y3DGEi8JN77hhksg:CsDGkiRBEJeDG03hCD

    Score
    1/10
    • Target

      x86/api-ms-win-crt-filesystem-l1-1-0.dll

    • Size

      19KB

    • MD5

      14f407d94c77b1b0039ae2c89b07a2ff

    • SHA1

      528b91a8a8611da45463fac0a6bd5c58233f8fbc

    • SHA256

      85b1b189ce9e3c6f4d2efdd4cd82b0807f681bea2d28851caaf545990de99000

    • SHA512

      152b97a656acd984592bf58854222ec97c661f9f8d19557ea03501457fb5a07821f90d332f21b1b51a5bce5ab84f862354b8ee21c7c1f6b7aa1c127f4a73ab5d

    • SSDEEP

      384:Wcq6nWm5CpWfhW++Y3DGk8ZpH3GCJErNi4H+Y3DGUfhd8JN77hhcu:G6nWm5CeBDGkiRBEp5DGk63hqu

    Score
    1/10
    • Target

      x86/api-ms-win-crt-heap-l1-1-0.dll

    • Size

      18KB

    • MD5

      9c373c00ac3138233bdf1655c7be8e86

    • SHA1

      ee38f868e32950d1b8185249edc6ad4e1bc5592f

    • SHA256

      0166edfb23cfc77519c97862a538a69b5d805d6a17d6e235f46927af5c04b3c9

    • SHA512

      d2f56b3169c1fea1a604523b2215dbad02c6306bd804445b367756f288310554dd049aefd024babc26a3b270b8aede8b10e5ec8d80e772d3d1076b8013491067

    • SSDEEP

      384:WgY3eRWfhWn+Y3DGk8ZpH3GCJErTpTX+Y3DGUm8JN77hhwJ:TGeDGkiRBERTVDGm3hiJ

    Score
    1/10
    • Target

      x86/api-ms-win-crt-locale-l1-1-0.dll

    • Size

      17KB

    • MD5

      c5d747f96237b6e9aa85c58745d30c80

    • SHA1

      c6ad21597265faf25ea8d7f09577f3e6f4f7be10

    • SHA256

      f16447b5fc7fe6fb8a6699a3cef1b2b8ba92d408579bcc272d3dd76acd801e2a

    • SHA512

      5bcee06d62633ecdfdf5dd1bf92ff9278f535dc5f21bfe36faaca15e378beb4da6be7ba9767569119fbf9f7383ffdb3a4a17c99d5918a64b8e12926ac0ec3140

    • SSDEEP

      384:WVWfhW2+Y3DGk8ZpH3GCJErYIcc+Y3DGUA8JN77hhKdf:JxDGkiRBE44DGk3h09

    Score
    1/10
    • Target

      x86/api-ms-win-crt-math-l1-1-0.dll

    • Size

      26KB

    • MD5

      bc418a3461c5fdfa1a0d75f7e03d08a7

    • SHA1

      5cfefa62226f117b7e2fe58961269294eb62b84c

    • SHA256

      c7115159babdaa1f52e478e67b4e612da2332fda4e4036999b29425fe303b6e8

    • SHA512

      4c9f3d461a5fc42d829d517ef523423ceb18f6667e6f2d83f1e5cd645a359d32b58ac8652ea734f567ed3b9e2999f358bf0e95bf38265df7abe3fe4b2f5fa978

    • SSDEEP

      384:WXQUbM4Oe59Ckb1hgmLVWfhWC+Y3DGk8ZpH3GCJEr0a6eOq+Y3DGUOe8JN77hhoq:SRMq59Bb1jyRDGkiRBEQeOODGp3hqQ

    Score
    1/10
    • Target

      x86/api-ms-win-crt-multibyte-l1-1-0.dll

    • Size

      25KB

    • MD5

      9e9c6f83a015029808f5257f7b7e39c6

    • SHA1

      5674192eb60eb152773fe0d50161f32759e2ea0f

    • SHA256

      c6b4e1d903b3cc83bfaffbe4e82eee634cff8f97f12217caa45b464ddc4e1455

    • SHA512

      6e124732646cbe95ef94773d57b08c68a399854f906b14f15996bb12400d5e92b34596c38795a3ba4cdf8db4e8dd5ad486890634951a4686c6679b486ab19cb0

    • SSDEEP

      384:WPy+Kr6aLPmIHJI6/CpG3t2G3t4odXLVWfhWS+Y3DGk8ZpH3GCJErRMOnR+Y3DG3:uZKrZPmIHJI6kVDGkiRBE9nDGa3hYV

    Score
    1/10
    • Target

      x86/api-ms-win-crt-private-l1-1-0.dll

    • Size

      68KB

    • MD5

      ad8d9a6ea592a6c8a78c67a805cec952

    • SHA1

      3e9f35013044be456f33e300418453ab12c70df8

    • SHA256

      696c10112d8b86a46e5057cbd0bf40728e79c6bb49cda1f2c67fe45d0fc1258d

    • SHA512

      31c1b5717432b67e6b150911747f34e8099c1a0870262bb3b5d3ac5c9e28b3b08e4239bd105408318806f983b3fcd10e617b2385511c46efe9fe58a9cd4a7067

    • SSDEEP

      1536:b/XeuJDe5c4bFe2JyhcvxXWpD7d3334BkZn+P7niDv3hO3:DXeuJDe5c4bFe2JyhcvxXWpD7d3334BD

    Score
    1/10
    • Target

      x86/api-ms-win-crt-process-l1-1-0.dll

    • Size

      18KB

    • MD5

      66f4e530a19ed2f6862b5ce946437875

    • SHA1

      016bfa4eafb407e43abdcd9582dbca7dcf85d3de

    • SHA256

      542a22540cdb7df46d957a0208d50507916f7c737bea833931239d56ebe8d68c

    • SHA512

      2653b2118f4db250850dcefd3536e0fd2bc55e9774376b51e586658e4e5d79a35cb425ebe0a8391124997e24c8aaa84bac799162a31446ef47db667a4a3f0eb9

    • SSDEEP

      384:W3KAWfhWk+Y3DGk8ZpH3GCJErW25tL+Y3DGURRQ8JN77hhGz:fDDGkiRBEy4BDG43hgz

    Score
    1/10

MITRE ATT&CK Enterprise v16

Tasks