9bd8070dabcd70a366a634e32c0ce060aef82512b4da283b75caa70147ea8826

Sharing

Copy URL Twitter E-mail

General

Target
UnixStealerV2.rar
Size 679KB
Sample260718-a6f3psex9v
SHA256 9bd8070dabcd70a366a634e32c0ce060aef82512b4da283b75caa70147ea8826
MD5 a81793a30b7e622eb1f0fb107a2b931c
SHA1 71fbf6b4ad1f1894ffb378d28683058c0e29c026
SHA512 87209619e0ac54f124d0700872d73c974d7d85d279d8e13cc6ae1eee0417029be847ee8c8ec13b32cf0188f2a7d5b27e3f15555476f7ab9e6fc92cf98bb40a7d
SSDEEP 12288:rfNMympO0ijhIg9TqoR3pVWwBcvZ+k/ju3/NCw3PCAxe0uYUja68u028QUQDA:rfmpwIgHVHmvPS3bPXwtY4anu0YA
TLSH
T19EE433705F599B2396A28977A9937C146E84022E7178C215CB7F037B66EC50FE12C2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  UnixStealerV2.rar
- Size 679KB
- SHA256 9bd8070dabcd70a366a634e32c0ce060aef82512b4da283b75caa70147ea8826
- MD5 a81793a30b7e622eb1f0fb107a2b931c
- SHA1 71fbf6b4ad1f1894ffb378d28683058c0e29c026
- SHA512 87209619e0ac54f124d0700872d73c974d7d85d279d8e13cc6ae1eee0417029be847ee8c8ec13b32cf0188f2a7d5b27e3f15555476f7ab9e6fc92cf98bb40a7d
- SSDEEP 12288:rfNMympO0ijhIg9TqoR3pVWwBcvZ+k/ju3/NCw3PCAxe0uYUja68u028QUQDA:rfmpwIgHVHmvPS3bPXwtY4anu0YA
- TLSH
  T19EE433705F599B2396A28977A9937C146E84022E7178C215CB7F037B66EC50FE12C2B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  UnixStealerV2/Builder.dll
- Size 31KB
- SHA256 3ba937c60ebb6a47149f3f17ed26f8d7926f51c4fd665be7af5c1b6bcfbf44a3
- MD5 cefc8e17a678f07e1fec33c1c92afe36
- SHA1 aefde8a313348e876a47da0881c24e09306a3e9f
- SHA512 8009ac41ce7e4c6ca7e7e3ff5515c9ff9cbcb0a973fa44a2d49ccfc8c51a7c42f77550ebeb0d3edd23cf859c43e04f139cc078d282591eaafe62b7463cfb2141
- SSDEEP 768:PuCA0HcjIq+7pwDIcq+GVWOuPBNjR9dlJ8U:PfA0HcjIq+7pqqRVB0TR9TqU
- TLSH
  T121E2180177F84A27E27E87B42BF1924907F3F5661162CBDD2DDA70DA40E2B604621F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  UnixStealerV2/Builder.exe
- Size 147KB
- SHA256 8158bbcd71f29aed2855c6ee6f3e48239e4e2c78739bfd10d441a6d18f11fd40
- MD5 f2dfb8bdf2c71e609fe3b08e947fe439
- SHA1 18bb013f1cd3ea22f3366bc94f4a3704b4a06447
- SHA512 4bbc32a95f31b3cec7b0b6b8aeaa88965159ea98cd448ac45c1bd70a6383ed5ae13443889dce537a15c8b768da1af712cdfdbccb3f6835539d0f52a374517ca8
- SSDEEP 3072:t5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCgoC:tBKjK2LFzZNfIULl
- TLSH
  T1CBE3280772AD11E8D1BBE23D89A24902F7B63826473597DF1350427A0F777E0AEB9721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection discovery persistence privilege_escalation spyware stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3
- Target
  UnixStealerV2/Builder.runtimeconfig.json
- Size 372B
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH
  T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral4
- Target
  UnixStealerV2/Mono.Cecil.Mdb.dll
- Size 38KB
- SHA256 61637f9940e5e336571cbf945be0f36d6d6050e06288df0f0232d93b26f0bde7
- MD5 0c4ec4eb146bfe047755669c8060a967
- SHA1 f663cc3bc174a98a49893e0cf334b479b05e453d
- SHA512 478dba76de5b20906a31f2ff72a559779a262abe0265d475aa60d555d4f94f79887f237f393f256134be758d565aa46b30a39e81b23e1f3048fc80ab779405af
- SSDEEP 768:WrF3HuZyOt78PeWSTlNeyJOgfGNOV/DVxPVxaCCrHpTFuYL4oWp:WrFecOt78PeWCLOgfGkVzmpTDL4oWp
- TLSH
  T1FA0307087BAD962BC2AE56FEE4A126191BF1D53C6603FBAB4DC4B0F3BC437444112267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  UnixStealerV2/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 a5249a04ad8fd7dfd47e4d0a620aed0f7eb6051e1ddec102c541ca3e12f6e2a8
- MD5 743102d277a8754dc74f7644e03a8956
- SHA1 31971747d45f995bc8d05c26c728df293a074db6
- SHA512 00bb76043a3a147b570e0421f768a2f2238954922c45c611d10d8fd4a1f8ba56da8a7b7377facfe54ff6dbee2d81be87c0d6e3de9e884625697ae478a82677e9
- SSDEEP 1536:QOTXdiVgzDKG2fNRck9FRcXRHr5vMALYKXNgJGsZ9ajr1vjCXev:TT0W2fjvm9uArWJGca31veXev
- TLSH
  T111937E29ABECA666E4DC72B724A709084BF0E165D143D71D9AC47EFC2C5BB121923393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  UnixStealerV2/Mono.Cecil.Rocks.dll
- Size 24KB
- SHA256 273292babd45f9f34de5054bd9cdfe1d859a7dbf6f4ad5974fe4ead70698ed5b
- MD5 fe8c2b2eef6e5e7284dc9b522a7be468
- SHA1 8779911266ea9bfea924aad33a7e1c7855f41857
- SHA512 b78f759568fa5ce77f87db6f02688493877ced8c9b289934c6adc95db5581d3ebc858092c650a47d5d7eb44c2dd2ed01a8491930acd8173d45f777285d0990ab
- SSDEEP 384:aWLOZBsQXmnFlPQnqc9H559krjuVXcVXD9PmROMLUBLMWG1UX8JvbrjEZ1O/pl+1:5aQHP+qcbkrjuROoUBBLXA/AS
- TLSH
  T177B239103B99CF3BD2FF867958D2532802B1C96A5603EB064DCC90EA9A5BF945341BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  UnixStealerV2/Mono.Cecil.dll
- Size 348KB
- SHA256 769a59793d4b8885bbbfbc5aee8f57a0d4e34d275c56c60c03994309b87f67e9
- MD5 7c40214d60b54749a1a7f79ea6f62bac
- SHA1 a240d705b52fb1a78cceedab268db42cbeb47512
- SHA512 66a489988d15f1c651061656703b6fb03c4c6ebe82bcb0d48246c760e3764e4a7f2ad8d1653c90401fba6aa9974586d36256ad3a47e1112c1f38488a8818ab92
- SSDEEP 6144:NimznQ2nMpRAX2diEIn5o4gcuomZSFrIb:XnB2EELcu0Fr
- TLSH
  T1C6747D3527EC873BE69E537FE46A081A82F5D816738BEB8D18C8E9F51C43B5359011A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  UnixStealerV2/Spectre.Console.dll
- Size 794KB
- SHA256 842fd97e58fbbac48ccdda0e575b14a1b8af75c42ef87911fddfeda5b7bdbbc5
- MD5 2a47203be983f3dac02c9df64550a25d
- SHA1 d728230fe3cbb43b5cab7ddb6e018ec22955e766
- SHA512 89e969397a32e743b34037998435b16cfa35475ea1898ba495a3e9cfa33022fd6482678d497a962362fd0203d454893b53fa0cdebce44a0c6ccea538b3c02c35
- SSDEEP 12288:KbiZiRA2wChnq791r++f7lWv+YnPXNKCiQGCniCUzSN:XZklnm911CPdKCiQ9nN
- TLSH
  T18E057C2633E487A7F1ED8A34D8B9261055F1A99A5211DE4FADC858CA1FF3741FC01BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  UnixStealerV2/Stub/stub.exe
- Size 258KB
- SHA256 59b20774e811849ca7a4f333045604e1517b72a0b47373a7328422c84012c03e
- MD5 48abcd1cfeef155b40f7f0930ac9f779
- SHA1 9939b8f80b4ceea31b4466930fcbcd7c4a1683e0
- SHA512 8ef27cf51a1a89d4529286e14cfcb6e1e1a4b4521af6545baba032cba395bbe4d3d51fb54a8565f9ca93f844ac15e5e9edadc6a9cb3120e665362e94f0079bf7
- SSDEEP 3072:3XQrUaL0q+r9Eq9nhxdfRIUBAfqwcU9JX6/u3Quo5tUCw1kNXztO/QJkhapKJIdn:CknlfptwlF+wOzxJ4a5uRvLrKYzIFPv
- TLSH
  T17C443A6833F94A15F3BF8B71A8B094914676F82AAD1AE74C1D8524DC2F32750EE11B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral10