General
- Target LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
- Size 3.3MB
- Sample251020-v11kdacm2x
- SHA256 6f2d0f89930a4ea9854071442a7c72a1e657c5958759fee694acf6bf24623698
Malware Config
Targets
-
- Target LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
- Size 3.3MB
- SHA256 6f2d0f89930a4ea9854071442a7c72a1e657c5958759fee694acf6bf24623698
Score10/10Guerrilla
Guerrilla is an Android malware used by the Lemon Group threat actor.
Guerrilla family
Guerrilla payload
Otpstealer
Otpstealer is an Android SMS Stealer that targets OTP first seen in February 2022.
Otpstealer family
Otpstealer payload
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
Possible privilege escalation attempt
Creates new service(s)
Modifies file permissions
Adds Run key to start application
Downloads MZ/PE file
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
2SIP and Trust Provider Hijacking
2