033cccbb21da8dffb2516af78afb587519216c929139fa16e908546c335a7a88

Sharing

Copy URL Twitter E-mail

General

Target
kylermcleanepjy_0.8.0.zip
Size 109.7MB
Sample260702-ml9kqsev4m
SHA256 033cccbb21da8dffb2516af78afb587519216c929139fa16e908546c335a7a88
MD5 8ae472ef20e1e76b4e6027dcb5ded1ca
SHA1 fd101b088d1984dfa61e5fbd6fbef54999861591
SHA512 be26a238d8e9bd4d03dc0cbddb66b69e7b4b1b9146c862b358c2930b744b4fba1eb56e82e4eed31dd560c22740ce984f2ec62b3b06d7d37398b7e495ed9d66c7
SSDEEP 3145728:pUJ3Jr8EZVkJMc+imTUOpFx2H2V22X8uw4DH07w7Y98ET:pAfiDOrGy22X8uJDZ7YBT
TLSH
T1E04833C0CD4064D5299F662BED8073FEECEEB516D0A758DD407AB4AD4672AB381F0A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  README.md
- Size 137B
- SHA256 b0960afbdcd112e17b2f6b96b79809af173d201b4c7f31c22c09cb5b2bb6a8da
- MD5 d8607f51a46f2fadbb13c5fac65882b3
- SHA1 6cd34247834c8e98d47c7f2d2fd22e7d87a57bc5
- SHA512 e5d0a24a6b8b9b4323a512aa327a339046b94b9ed111b418a7457726b1dc57f1e859e898b9d38a92bbd8e1f48d129ee2bdb93a11c33f395b98141cb604aee790
- TLSH
  T1D2C02B552512E33020020EC2C49633C18781A480000F549123C001CC011D6D385089CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1
- Target
  cmutil.dll
- Size 26.1MB
- SHA256 f2cb8643ee7edc5003b7ed0ef3e9f6b94ec24cb55ab53e99ea94d39c888ec25e
- MD5 1f8fbe63c3dd53c5f58b6082dbd20899
- SHA1 68722946220f003ce62070c265e9ed2901711854
- SHA512 f23d9a26656e48cc7444f7a709e66e286fd52e5a33504c7c311534be51ce5a04aadbf8c99e1a6d068c2eecabdbedd8e0c4a87dd6acc4c3bc580f7d0b78df157d
- SSDEEP 49152:cSYCgL8V4navRfG0VgPnqXR9SxgSyyjFeupPnfE8aIIht0v0phF1ipkmlVb6bueE:RFI
- TLSH
  T125577533710771770E8140A6E26351938EBCB3A91732A5F6F46D820C75EE4E857B7AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  kylermcleanepjy_0.8.0.exe
- Size 80KB
- SHA256 2eb8278210434ced87711889ba19582b7a104190310d2a06f0855a9cf5772d11
- MD5 d7aabfab5befd53ba3a27bd48f3cc675
- SHA1 e1e2758e7427ffef7d943ef1ae9024af76a9142f
- SHA512 aa1e9d9614808bbd53182702d1e0e6b13b70b9b42ebc8f7cafbf4356d2eeaee10955710503edfe485e095335959db92d1f123588a536fc172e2cdb03f37b64ff
- SSDEEP 1536:kvsrU8tbNyQmvDV7zdIpCFo80PA3OBk62FH/IwRw1lqCDo:kErU8tbUQmvDjYndW/IwRw1MC
- TLSH
  T1C4832A4277DC4060F2F256326BB599318A3B7C315F75DDAEE7108A4A2970E80DBB4B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  model.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  x86/config.json
- Size 3.8MB
- SHA256 78695d93aa5816a9286d98cd43fe3e91480f5e75c2f093cd0b9770063a0547fd
- MD5 ffa03d1ac6fe3edac1e3d832161b952b
- SHA1 dcf841ba1a9eaad351b0999dfb827cf68e65e945
- SHA512 80983b46723c16766bf68578c61a420ac76780164030fdb37db3c66b8b99ab69b0376f8d01134636a7a314f373d899bb385ae1b3cb069c9c7cbf3e1c4d90baf7
- SSDEEP 49152:NujhpVsu5uFj6n3LUI8JxYA+Wypu41rhWSsdIpJh1nuv6j0+43/pFjDAwBMWpBCt:IhHsQl4ZswrARgvhiWaOuBu0ijfs
- TLSH
  T1B5167C5B75A84196D076C038C957AB0BEBB1BC564730A7CB22A0372D1F737A06ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  x86/core.dll
- Size 12.4MB
- SHA256 1164952add16666920be10f8a91364700ce965d237e85ca72fc63397b8e68de5
- MD5 71ec18ba5b3578bc2e88f64d60ca0797
- SHA1 23fc447c1f77a0167dccb5cbb5deec32014cac31
- SHA512 f9deea04df889fc493e5d12471451aa1590e15afb4019337fb1a296ca2286dd93f883b255ecf7e1bd84c35b887d425d837ef68ef9cce7ebe58df36ae77ac827a
- SSDEEP 98304:B8jd6lrLddIRBGprPmt/gP2XwIrlw168rk3PFHU:UiVd5PQ/gPawklw19k3Py
- TLSH
  T14ED69E86F0D665ADD617407421BFBB127D213E64425C0DF742E2E9B81FBA7403F2AE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  x86/corel.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  x86/logo.png
- Size 2KB
- SHA256 1ab5e48c00466566f48abae9f930d040ee769ef45533904fd39353d20abd1c0b
- MD5 42803be77cb01d8a75cc5952a8ee565d
- SHA1 f37297def55eb7dbc87812fd9c503aa4160b7cd4
- SHA512 d5796e23d4f9053eb6398d6f984b43d0680c37036a99be9e81b92438437bf01e60d7f41824661a44aaed4d60ad4d7f90026068c585588038036cef98a4ae74a0
- TLSH
  T16F5119C361FCA15B137B8E58EBC62B7A869900327A7B5D4804759FB7D1A994C331CA88
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  x86/obsidian-source.dll
- Size 95.0MB
- SHA256 a29daf1b537ab3cc653b62849348b8459e328b874b947f2d1a87b7b33dca09ac
- MD5 203874655c31694988df5160c40787d1
- SHA1 bba49e2f4e2b541492ef2e31f825d162c3b356a9
- SHA512 9472e2f42e07a4099e649454428bd6cec7febd57c4d8800a2dbf0e2cc07b97f39a3bee23eb73f964fdc71b416dbed1e86791a25b20a83d1202d19565f43fa730
- SSDEEP 1572864:t9Q1VxiPhNrce8VtCqS5r3QQvzBycQJ6cSeuwafXmhy+cQC6lvRFBYvy6pq74xn2:t94YhZ8VMqSGytQIZNjYdKdM8xgRUitT
- TLSH
  T10D2833C54E4084E229A6741ABCC171F9FDEBFB1390B7ADC9482EB1AD433AA7241F4574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateUserProcessOtherParentProcess

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9