ff6ab6fab389da802db676a2f428f2254eebaef7d95f318360d8e9e1f3629140

Sharing

Copy URL Twitter E-mail

General

Target
CrealV8.zip
Size 79.1MB
Sample250705-ntlpbaypx2
SHA256 ff6ab6fab389da802db676a2f428f2254eebaef7d95f318360d8e9e1f3629140
MD5 c5d01f0a62e08c3d26c73e24ab7d8dda
SHA1 4e3a5c6600255341034aa51b1a1d2af895161f18
SHA512 730405c6cc02225f8a4bb5f91b432cdbeb80bcb973d405df7c231db21d744cf761d6cbabf9af39ec6104951f4a89c62f6d8434beff585dfc5bb9842e128b4c00
SSDEEP 1572864:yETRjnTN1ZToyq3K8xam46sYUX8+aO22eDuKP21CbHuXrv9+ahm7+fWQRT8pgeNF:yAR75foyq3K8xqX22eqU21CrI9wFNRX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  CrealV8/CrealV8.exe
- Size 164.7MB
- SHA256 aca87476850d0cf4269d9ca8a12d18c68f0643cd6c3526ccf7ca5444f8e5bf46
- MD5 86d79247618e90a72b16f21ab1102848
- SHA1 532d8cc5fc34542301fea2db27ace0347033b622
- SHA512 a0dbbc4e36a97cc3e26e894f2d51350e5c51f11ef60ab7ef21ae5a3b7195a5e3dd9f8752f7100849d96ae1542dbc1ed7f518857f1960c4d6019a1c5d1185db46
- SSDEEP 1572864:EmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:asFWY7ihS4kVP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

defense_evasion discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  CrealV8/LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  CrealV8/d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  CrealV8/ffmpeg.dll
- Size 2.8MB
- SHA256 9d1eb0c6eb12bfa87e74a65c2fde5d61c4c93e21fb0800bbdccb6559527036a5
- MD5 14e00bf1d9d0df65f8b1a31240d474a8
- SHA1 f9fe033725b7b1b5c0efce7a14ed7ab223cb32e8
- SHA512 652724450296a739de802ba8fac482953146f37665718446e448a350295e1e7b09bd460835bcd0ac26b2e54bb9b791624a9eea11e6c96573c7c4aed22450ed14
- SSDEEP 49152:IF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQ1SCu:IFvSkJXv+tiLAD0+D1S5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6 behavioral7
- Target
  CrealV8/libEGL.dll
- Size 477KB
- SHA256 9cfc3001191e8b3eb9c96ba29e57e5bf9aaab264e83897e47cb968167a8a811b
- MD5 1dcf5ac3cb0dcda9c9679eeb018d01bd
- SHA1 bc21697c5665aab5eaaba61f55719d43328f7e7c
- SHA512 47d8769bf00cc7555479542abf5e0684799e424d9801dad8c6bd199680d9c40cfa2380d969515db7a0753cf6f3a9733b5afb931fe33863fe30a37092d8dc96b1
- SSDEEP 6144:o8hd1BSjuMmof2SEXVVfgV8hxN7h2NIIEOg51f0FticyQ:o8DXSjZmof2SEsmN12NIIE7f0FticyQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8 behavioral9
- Target
  CrealV8/libGLESv2.dll
- Size 7.3MB
- SHA256 80c2ef6ca6d0ff4877bd0c0bc082ff19c3a5002d53648bcf5f54368560f9a411
- MD5 51378647d290f3a08affa8454a3d59d5
- SHA1 32152a6677c82ea9e2e842baa907d708b46a6779
- SHA512 ca90f5131d95fdb1e4a5cb7cb2bbef08676f70367b255270871754f776937994e34258084bf46437b25e1745728c279594d64e0718643eac0ac00cfc43d2c53b
- SSDEEP 98304:1aUIRsMRk/yUt1ngliXWeamn0B8LfdAbvZ3gtT7:1anxRk/Pwzedpag1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11
- Target
  CrealV8/resources/app.asar.unpacked/node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral12 behavioral13
- Target
  CrealV8/resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15
- Target
  CrealV8/resources/app.asar.unpacked/node_modules/iloverte/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
- MD5 0b33e83d33b01a51625a0fdcbef42ce3
- SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
- SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral16 behavioral17
- Target
  CrealV8/resources/app.asar.unpacked/node_modules/iloverte/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
- MD5 04bfbfec8db966420fe4c7b85ebb506a
- SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
- SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
- SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  CrealV8/resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  CrealV8/resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
- Size 224B
- SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- MD5 f0a82a6a6043bf87899114337c67df6c
- SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
- SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral22 behavioral23
- Target
  sqlite-autoconf-3440200/Makefile.fallback
- Size 547B
- SHA256 67d473327dd92f5cad68fddb78b8bb3e8745aba851147945893e4db5a2b59892
- MD5 8ff4cdbeec29d794549a0aa48da06bc3
- SHA1 7fd897fc720b6c9c6f760867c97a95431fa4693e
- SHA512 9871a654d8b140ad5d6768d385b86ba7f32927f8ed6374e62c93db99be4a40841f6900d648f33d07dc118b6ea93f00c45f53e4b675643b2b487c9c0df1ea1474
- MD5 SHA1 SHA512
Score

1^/10
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  sqlite-autoconf-3440200/Replace.cs
- Size 7KB
- SHA256 74ba0687a84c328df2836f73d7d36368099a5f5c1c360a84211e51fa71f1dfc0
- MD5 335ee30449b5d0d52ab314dbff93d52f
- SHA1 02c67258801c2fb5f63231e0ac0f220b4b36ba91
- SHA512 02f40bc955c833105811f78471e29f062c1cebfe4bd96ffba941670c0026ad5bbc81f336b7c2c6b9f804c67ed46c9dabab927ec0fb4c709bd7a049454f27073a
- SSDEEP 96:lJC/3zjNPMMQIQBmajlyM3px6D3t1KO4vNoHyJ:l0iAM3vlO4vNcyJ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral28 behavioral29
- Target
  sqlite-autoconf-3440200/aclocal.m4
- Size 364KB
- SHA256 a459cf9e72aa3bf51c748226e37c2e192144047e3b1a5173119b92fa62f2bf82
- MD5 6f9e7a7b0ab591c27b3cbf01a3c1036a
- SHA1 1f464e1017c18769c630a1d4fbfe9acd57a303ec
- SHA512 aa0aec1a3442ecf4bbcdb908f32d72803e0988ca0b3d6ebaf32a49a2a898328c3bb71cf77ca3b062d55ccec9d86953fa52ddf02460d7724de09a4efb38d8ef7d
- SSDEEP 6144:tdAwSQSqrgHFnOvwYAU9FWgi/2WDg5+YaNk56cHrYw+Zg+XrZsGEREYRGAFU25tt:rAtM7E0LQNnc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral30 behavioral31
- Target
  sqlite-autoconf-3440200/configure
- Size 485KB
- SHA256 e4fd1a4c97d06f37d55eadf277cbcc62f01bf505c743ae50db90117457042c20
- MD5 a3cfbb77ff42001bb363783c3b2dd261
- SHA1 9b222ed32dd27dc2b2bba00e7c2fbd1a0ac5974d
- SHA512 6e6a70a449d52ebe05b74124ba47476764bc3c0d640b3f32d6f9b46fe31b1842fb469792705215627398c88e0f0a0f64f1590e438f0bce92bedca1c68ebb0cd5
- SSDEEP 6144:X0hKTRerWD0QrR482PTxJToVL6APIudUVQUszNr3+5c+D+hmCk7XDSy+va++XYK4:ChKIJ3C1IJ4p5Z7H1eAvySpjxhH
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32