612e1e3b80a32e645809f904df43b54f80f74745f8c4aa46d7b345ab4560e074

Sharing

Copy URL Twitter E-mail

General

Target
NewBoty (3) (1).exe
Size 404.3MB
Sample260711-pqletact21
SHA256 612e1e3b80a32e645809f904df43b54f80f74745f8c4aa46d7b345ab4560e074
MD5 16b37e65729dc0f6ee69452f3e33b45c
SHA1 ffd4f480495aaf0da4d9a21bc716bba37abd5a68
SHA512 1cfe0b7109063a571f6907639224dd6f020135ac2aca9dab98d3741e267019b71589af99aafb502d76f79d90badc202b8ba9015c920a97c71739dadbc3ec6b5e
SSDEEP 12582912:+gnHzClii/CARamKuqUABNfU5I+g/Y0Iorb7:+2e/MIeNYIZA0zH7
TLSH
T1781933E6A7C66D52CC00DDBBD9D581B3B2DD3B139A7E181310C24D21BEE98829235F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  NewBoty (3) (1).exe
- Size 404.3MB
- SHA256 612e1e3b80a32e645809f904df43b54f80f74745f8c4aa46d7b345ab4560e074
- MD5 16b37e65729dc0f6ee69452f3e33b45c
- SHA1 ffd4f480495aaf0da4d9a21bc716bba37abd5a68
- SHA512 1cfe0b7109063a571f6907639224dd6f020135ac2aca9dab98d3741e267019b71589af99aafb502d76f79d90badc202b8ba9015c920a97c71739dadbc3ec6b5e
- SSDEEP 12582912:+gnHzClii/CARamKuqUABNfU5I+g/Y0Iorb7:+2e/MIeNYIZA0zH7
- TLSH
  T1781933E6A7C66D52CC00DDBBD9D581B3B2DD3B139A7E181310C24D21BEE98829235F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 5d545ce8065079f38a82472ab93bd62fcdf73cd319f0771ef51c45c7e243f1d4
- MD5 a1ee17d90caa1bf1f3726ec03842f18b
- SHA1 27a94b164c4255ce0dcab5c020f335a9cd3f8c60
- SHA512 d9f7448213a449535f1ff43090c08f0e2388af4e72ce2f59e0b1b457a831f76c0d7d69d88cd435b1682479d31d480b19a5488dc3ef6c133c974557d5bdbcf446
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmR3r8xsJQfiFTuoYQdVi2Hxj37D4h:f
- TLSH
  T11827B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10