General
- Target Flash-USDT-Tool.zip
- Size 10.7MB
- Sample260701-arpfjac12z
- SHA256 3f1f116c327d7d35af96e73ccf68b95d2422782d904f0715834b99e27a7465b4
Malware Config
Extracted
-
ps1
-
exe.dropper
https://bootstrap.pypa.io/get-pip.py
Targets
-
- Target Flash-USDT-Tool.zip
- Size 10.7MB
- SHA256 3f1f116c327d7d35af96e73ccf68b95d2422782d904f0715834b99e27a7465b4
Score1/10 -
- Target actions/__init__.py
- Size 66B
- SHA256 4ae221bd5e2f2c7d3b70a1d04a5610e86c8281520c731a3b6eb7a7e22b03a0d9
Score3/10 -
- Target actions/about.py
- Size 2KB
- SHA256 427f42b24d81f4455b0229278dafe1ddc030aefa83623b154ca7a9091ecce626
Score3/10 -
- Target actions/install.py
- Size 1KB
- SHA256 4ca6acf5b916c134eadf62904bf2e6f608ef6b2eb3bc55f289fe299f21d84c6a
Score3/10 -
- Target actions/settings.py
- Size 1KB
- SHA256 33620af670b03c3fcae2dc8b771dc77f488e35baf94569377ebf3c37bcf57dd6
Score3/10 -
- Target bot_actions.py
- Size 5KB
- SHA256 29052248279fd56c5aa63fe1e0a6ec5f372252cb4743aa6a3b0fa82977b5f1ab
Score3/10 -
- Target config.json
- Size 789B
- SHA256 6251742d3f23c077b556ee413cdc6dee8d0caaa24e50bc6f8350e07fab4e736a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target config.py
- Size 1KB
- SHA256 e371fc95e94ee3529c4e5243f6173cfe8b0a0bf09cb11874d178d75ebc55c83c
Score3/10 -
- Target main.py
- Size 3KB
- SHA256 c63cbfd86e5f5aef2fd167472a14757bc2deb41ad60ad088d0ab1a12e58f187c
Score3/10 -
- Target requirements.txt
- Size 113B
- SHA256 99bebc8822f6f433c6dddd68ed8d6610d9a76b4345a2e58fe366c3da2e07341a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target run.bat
- Size 622B
- SHA256 4990471ba1fd42bececad78c413f546a6252feeb22f426bdb9407e7f50512695
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target sdk/__init__.py
- Size 5KB
- SHA256 af72475817951bde06ad775d97661889df3884e0646236f18b74afa1df1433d7
Score3/10 -
- Target sdk/data/py_rt.pack
- Size 10.7MB
- SHA256 7729172ace172ceff50a4f28395d24629e4196ac85ec12789377e060b0091be3
Score1/10 -
- Target .build_id
- Size 26B
- SHA256 37609f0033706c6765bf4622c2cf23abc2030084f0383c7ca8e8f1dbad5c6031
Score3/10 -
- Target LICENSE.txt
- Size 36KB
- SHA256 e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419
Score1/10 -
- Target _asyncio.pyd
- Size 63KB
- SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3