Extracted

• • Target
    diceriggercom
  • Size 4KB
  • SHA256 e4102b93fc836ccbed9841ee3148b352ab3d36dc34cb1c6a7eaec200083c81b2
  • MD5 2d0eba6ac5124f2abb75f7f75017c692
  • SHA1 f559342af64385ede83e4ea08e0998f88874c2c5
  • SHA512 f9c14698595dc54e99e7cdcb5bf6063212d05b3cf0160edb41c3e055fd8e691ca072911e9cfcaebf3654c690c7f224933041894316c17b65c8eb6949c607da1c
  • SSDEEP 96:eqTWyi/X842nIjvQ6qfqap77H5aAxIaussBtUjbTKdkEYoR2rkxlXap308W+eZsb:/TWXz2+/q5HZaAxk+jbTKdhlRMkxNIkE
  • TLSH
    T1E8A1756BB90B77304B5211A8644E413C6CA04FB749919C7AB54C84BC0F9D7B5E361ADE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverydropperexecutionpersistencespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2