063e788adeb25059e3564270b1bfbbd48953ffa25b76369cd7047dc38472c7ff

Sharing

Copy URL Twitter E-mail

General

Target
Installer.zip
Size 8.4MB
Sample260623-qttq2ads2n
SHA256 063e788adeb25059e3564270b1bfbbd48953ffa25b76369cd7047dc38472c7ff
MD5 1555d773c131804785b863c76d90f443
SHA1 4599060e34bc389979e665b5ef43351640d278a6
SHA512 2eee5264e37186044f555b44e8d16a73d958df9a3ef387fe5e2c4f167c55d3aa964aec0e450ad7b5a145bf516bf91e785d730c9e6f9bd32aff1ebdaee11ed059
SSDEEP 196608:hftIaqkwn2804dqTX2mE5gU8y0z+5Af9GHVrOxOJmk1iO:RtJVwnjdqTX298yG+OfYhmkZ
TLSH
T1A99633562D237EB786D9C60BE385F79D0270A50D0214E195683DC06F1E82B0ABDEF9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  build.exe
- Size 2.9MB
- SHA256 29571eb079c469ee84ed580743f3632920435540adc9100cf91b40ff2ef7647a
- MD5 c4cc23fb7a38b9891faacc6d69bf0e0d
- SHA1 a1cbc16e96070d3e8f61322342e04b5e39e37ef7
- SHA512 652d424a53201af25a1dc691fd61b6df8ed55798c7f5217e01ad9c3af805f2478bd0d1683d2cfeb3d4dae0b7bcc300ff1ee35ca618878bd24f93c5f60edd8f8a
- SSDEEP 49152:RhZ/T6NR3qsRJ+TiK+7TuW0QVzM7AKOgzGwDsfPyFZEIgVj:RhBAV3H70QBY7OgzGwDsfPyFZEx
- TLSH
  T107E5AE076CE209F8C49967B289B552A27B38B8040F3967D32E50B7783E77BD09D3A745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  cfg/inspect menu.dll
- Size 3.8MB
- SHA256 d9d8d0359d7307b6342bb65d21ca5242ea8cef686ece2a53832f18fedaebee0f
- MD5 2363e2bc658b1742795bb1b2b34ecb8f
- SHA1 6b2534d8a4fa4fc5485b3c223dabf9ebcdde1ae2
- SHA512 269274d6c276a1f73a92fba0e681c904bc0c258dcefe141df82d47e635773a6c5760d06f63e24a81bb48e439e1b5cd03a9a8341b44f3299347e02be2be68914b
- SSDEEP 49152:Xp96CB1AwJNstlVfm7EVWbvO9qpM2/Ag5l1pt5qJ7pKFGxM/xWRqqfTn+o:XNSo7vjdn31VqJtKFGa/xWRl7+o
- TLSH
  T121069D02EF811C69C4A5A33148B69742777C7C451B3A37E72E9076B93F727C0A936B68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  cfg/set.dll
- Size 3.8MB
- SHA256 d9d8d0359d7307b6342bb65d21ca5242ea8cef686ece2a53832f18fedaebee0f
- MD5 2363e2bc658b1742795bb1b2b34ecb8f
- SHA1 6b2534d8a4fa4fc5485b3c223dabf9ebcdde1ae2
- SHA512 269274d6c276a1f73a92fba0e681c904bc0c258dcefe141df82d47e635773a6c5760d06f63e24a81bb48e439e1b5cd03a9a8341b44f3299347e02be2be68914b
- SSDEEP 49152:Xp96CB1AwJNstlVfm7EVWbvO9qpM2/Ag5l1pt5qJ7pKFGxM/xWRqqfTn+o:XNSo7vjdn31VqJtKFGa/xWRl7+o
- TLSH
  T121069D02EF811C69C4A5A33148B69742777C7C451B3A37E72E9076B93F727C0A936B68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  cfg/settings.dll
- Size 3.8MB
- SHA256 d9d8d0359d7307b6342bb65d21ca5242ea8cef686ece2a53832f18fedaebee0f
- MD5 2363e2bc658b1742795bb1b2b34ecb8f
- SHA1 6b2534d8a4fa4fc5485b3c223dabf9ebcdde1ae2
- SHA512 269274d6c276a1f73a92fba0e681c904bc0c258dcefe141df82d47e635773a6c5760d06f63e24a81bb48e439e1b5cd03a9a8341b44f3299347e02be2be68914b
- SSDEEP 49152:Xp96CB1AwJNstlVfm7EVWbvO9qpM2/Ag5l1pt5qJ7pKFGxM/xWRqqfTn+o:XNSo7vjdn31VqJtKFGa/xWRl7+o
- TLSH
  T121069D02EF811C69C4A5A33148B69742777C7C451B3A37E72E9076B93F727C0A936B68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  mpclient.dll
- Size 3.8MB
- SHA256 d9d8d0359d7307b6342bb65d21ca5242ea8cef686ece2a53832f18fedaebee0f
- MD5 2363e2bc658b1742795bb1b2b34ecb8f
- SHA1 6b2534d8a4fa4fc5485b3c223dabf9ebcdde1ae2
- SHA512 269274d6c276a1f73a92fba0e681c904bc0c258dcefe141df82d47e635773a6c5760d06f63e24a81bb48e439e1b5cd03a9a8341b44f3299347e02be2be68914b
- SSDEEP 49152:Xp96CB1AwJNstlVfm7EVWbvO9qpM2/Ag5l1pt5qJ7pKFGxM/xWRqqfTn+o:XNSo7vjdn31VqJtKFGa/xWRl7+o
- TLSH
  T121069D02EF811C69C4A5A33148B69742777C7C451B3A37E72E9076B93F727C0A936B68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateProcessExOtherParentProcess

Badlisted process makes network request

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Badlisted process makes network request

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Badlisted process makes network request

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10