General
- Target CS2_Bilal.exe
- Size 191.0MB
- Sample260622-m82hmsbs3l
- SHA256 25cd207666fa2b4f40b63b2bb09bedca061133fdfd28c8601e30341e688229a4
- MD5 04a758718e46186f819ccb797f1913cc
- SHA1 2fac6a8258fc37b9a2d4b12c45d0f088a31af8b9
- SHA512 b614ab6dd82e52b890a9ebad551c7c7965f64410e39f95a8afe46318843dd66f102a06a549d74d45944103e7dee7990a5eed0221acde4d0fdbec1cd7a79086a8
- SSDEEP 3145728:R2N3dnnWUTSlkxtVsmJnSx1J1VkXdoCV0JBo4sZYegVP7IBSjhtR7KBPlp:R2N3zxtVvnKvVSzV0o4saIoK1l
- TLSH T131A8E043B3A500D5D5BBD178CA4B8613E6B2BC190331A7DB1564AB692F33BE12B7E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CS2_Bilal.exe
Resource
win10v2004-20260513-en
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
CS2_Bilal.exe
Resource
win11ltsc2024-20260617-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target CS2_Bilal.exe
- Size 191.0MB
- SHA256 25cd207666fa2b4f40b63b2bb09bedca061133fdfd28c8601e30341e688229a4
- MD5 04a758718e46186f819ccb797f1913cc
- SHA1 2fac6a8258fc37b9a2d4b12c45d0f088a31af8b9
- SHA512 b614ab6dd82e52b890a9ebad551c7c7965f64410e39f95a8afe46318843dd66f102a06a549d74d45944103e7dee7990a5eed0221acde4d0fdbec1cd7a79086a8
- SSDEEP 3145728:R2N3dnnWUTSlkxtVsmJnSx1J1VkXdoCV0JBo4sZYegVP7IBSjhtR7KBPlp:R2N3zxtVvnKvVSzV0o4saIoK1l
- TLSH T131A8E043B3A500D5D5BBD178CA4B8613E6B2BC190331A7DB1564AB692F33BE12B7E704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3