Extracted

• • Target
    a264795075062ef2a2ed1dcb42662b4b513229c3cbc924cad6bc35020849d391
  • Size 8.9MB
  • SHA256 a264795075062ef2a2ed1dcb42662b4b513229c3cbc924cad6bc35020849d391
  • MD5 c9269efe5a8b62a64375990e1b0e89c5
  • SHA1 186efc5673ff99f33b0dc4cb5ca49b9c80976728
  • SHA512 3200a8392e87fa1c0c2b2f23ddb74b6274ed12edb42dfbf3cca7a0f0b195290f2146eaae46fd2049198f25b2ddc0f1970631d97f37afb9b6b9804a162b5b94cd
  • SSDEEP 98304:CM/NX6EDAnN5gmc/pVaX+eAu93FrE5I2cxe0:C8NJAnN2mchVauc4C
  • TLSH
    T1C6964B17E8A255E8C0AAD5308A669263BB717C484B3177E72F50F7342F72BD0AE79710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionoreshki_stealerpersistenceprivilege_escalationspywarestealertrojan

  • Detects OreshkiStealer payload

  • OreshkiStealer

    OreshkiStealer is a stealer and trojan written in Golang.

    stealertrojanoreshki_stealer

  • Oreshki_stealer family

    oreshki_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information as a root user.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2