General
- Target SixSeven.exe
- Size 27.5MB
- Sample260509-dml2dsh16v
- SHA256 471a037a0fbb6c39b155b9d8d1eb4b826668e860cc239375ec409f5154691d8f
- MD5 a199516ed9e44f1dcbc93cc9bd00462d
- SHA1 2a27a26bd87c4fa46bf6d838679617118bb174bd
- SHA512 a045cb0a52f9b76f5de844e5717346f78ce9e0b63491962633f1b0532fb1ee1edfd0443aa1ded3f4f8711be47371c675d5a02cc2854864575b0b550bb1e5eef6
- SSDEEP 786432:NBdlBkzdQYLLsKMMo5ovsVuukuneG3MG10DbLloPUyOz:5lKcoeTZekMGcveMy6
- TLSH T1A45733D539B808ABF840A17BC0A3E564D7B2BC159BA0C55F47E533962FA72901A3FF50
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
SixSeven.exe
Resource
win10ltsc2021-20260126-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
SixSeven.exe
Resource
win10v2004-20260130-en
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
SixSeven.exe
Resource
win11-20260130-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target SixSeven.exe
- Size 27.5MB
- SHA256 471a037a0fbb6c39b155b9d8d1eb4b826668e860cc239375ec409f5154691d8f
- MD5 a199516ed9e44f1dcbc93cc9bd00462d
- SHA1 2a27a26bd87c4fa46bf6d838679617118bb174bd
- SHA512 a045cb0a52f9b76f5de844e5717346f78ce9e0b63491962633f1b0532fb1ee1edfd0443aa1ded3f4f8711be47371c675d5a02cc2854864575b0b550bb1e5eef6
- SSDEEP 786432:NBdlBkzdQYLLsKMMo5ovsVuukuneG3MG10DbLloPUyOz:5lKcoeTZekMGcveMy6
- TLSH T1A45733D539B808ABF840A17BC0A3E564D7B2BC159BA0C55F47E533962FA72901A3FF50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Tasks
static1
pyinstaller
Score
3/10
behavioral1
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealer
Score
7/10
behavioral2
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealer
Score
7/10
behavioral3
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealer
Score
7/10