hackbrowserdata

General

Target
NullXFIVEM.exe
Size 11.4MB
Sample260204-tpkjcaew2e
SHA256 68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16
MD5 a4af1b44f371e53cd243eca483f3111b
SHA1 dccf8ffe112865253fd752672a2626bb34c96aae
SHA512 24a5cd4adf15e1206549bb44aec8140c75596edb34b6c8d9e52b56c504f034f3e678202ee77178fae0f0438d08d810a2412d44962651bd6f9115c6b96859efbc
SSDEEP 196608:wDTEq55J2U61tNKjpY2mg53cLEF3d3nafyDIfKoI3xosyQXzjIAvB3LDeiXs:Enl2U61PK1Y2zb3aH1mjjIApPeiXs
TLSH
T152C63371CB8B4296DDBF4138CC3A111AF71DD6D5C16E3F9C76D0D6ABA2068E90B8D602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NullXFIVEM.exe
- Size 11.4MB
- SHA256 68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16
- MD5 a4af1b44f371e53cd243eca483f3111b
- SHA1 dccf8ffe112865253fd752672a2626bb34c96aae
- SHA512 24a5cd4adf15e1206549bb44aec8140c75596edb34b6c8d9e52b56c504f034f3e678202ee77178fae0f0438d08d810a2412d44962651bd6f9115c6b96859efbc
- SSDEEP 196608:wDTEq55J2U61tNKjpY2mg53cLEF3d3nafyDIfKoI3xosyQXzjIAvB3LDeiXs:Enl2U61PK1Y2zb3aH1mjjIApPeiXs
- TLSH
  T152C63371CB8B4296DDBF4138CC3A111AF71DD6D5C16E3F9C76D0D6ABA2068E90B8D602
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hackbrowserdata infostealer persistence privilege_escalation spyware stealer upx
- An open source browser data exporter written in golang.
- HackBrowserData
  An open source golang web browser extractor.
  infostealer hackbrowserdata
- Hackbrowserdata family
  hackbrowserdata
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  adafsf.exe
- Size 9.5MB
- SHA256 407b7cc72a8e37d0c2916e1ff0297b39aaeaee1389876df984220d167627591a
- MD5 690a49a8eea014d251dd47423b72da85
- SHA1 be9f786dc7710b603374bcdb14c39053469fa21d
- SHA512 34bc56de682b1203c98bfbd0ecd436fb25d62badbc9626dfa0e800830e6da84e88b6e6cbcce24b681a87af90a29a73c61c6675498ebfaabf9de1067fb48d2f5f
- SSDEEP 196608:FY7EiH9VBsfOFBAVNZndgk3hX8wedcnOKCw02j3WeFFTkGwIY/i9O:CpzBsfOjA/Zn2rgOgNLRY/ic
- TLSH
  T14EA63330CB8741D1E57A4674C628319DB71E6EC592FF3B682053FCB772B246A0B6C692
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hackbrowserdata infostealer persistence privilege_escalation spyware stealer upx
- An open source browser data exporter written in golang.
- HackBrowserData
  An open source golang web browser extractor.
  infostealer hackbrowserdata
- Hackbrowserdata family
  hackbrowserdata
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  ko pvp.exe
- Size 2.6MB
- SHA256 e10080c3b13c49ec96dcbeb694e8167f6630ea5f5cbae7bb60a83f3745cf05a6
- MD5 fce5bf9549199706bf0c3e22e2cf9ea2
- SHA1 a71533d382d8a99ed8b410bdbff268808505a12a
- SHA512 d8e0fce9802cf8aa760637aa39c29cd30bf959ab306e1cefa6fd09466751bff7e70f202a131f90aa75fccbd976ab1e803a43b13cffbbda01299f812dc0e522a1
- SSDEEP 49152:AmAOW92YVB4y3VLuxuMvAKrTZrNyAk2dEzkhT8pg8E:AiUfjVqxdAGTZ10t2
- TLSH
  T17FC5E065E09B872CDF622B3858546633C1A13CC943F0E7D36AEDCD706BA79B45ABC640
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6