General
- Target Seed-Generator-main.zip
- Size 10.8MB
- Sample260720-1w5lesfv7m
- SHA256 63309ed99985d165efb989010ce25aef31be5c787fd681b3e9a13312c2948b3a
Malware Config
Extracted
-
ps1
-
exe.dropper
https://bootstrap.pypa.io/get-pip.py
Targets
-
- Target Seed-Generator-main/__pycache__/bot_actions.cpython-311.pyc
- Size 21KB
- SHA256 d689610c5f456e48f77e0ced0f11a03dd0252e998a117160a06bd53c00ba8ea8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/__pycache__/config.cpython-311.pyc
- Size 2KB
- SHA256 9e0914ce7f4e282b07ea53e33576990c6b63a56060b81e8ef413fcec294f24a7
Score3/10 -
- Target Seed-Generator-main/__pycache__/main.cpython-311.pyc
- Size 6KB
- SHA256 fa658b2431c097611fefe1ba3f6162c3b57c5d7ee5240afd88db4fa187e9c2cb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/actions/__init__.py
- Size 24B
- SHA256 8b084a9f378124b2b1a51563bf3c22444eb7ff33692017da28b2136ae56987ed
Score3/10 -
- Target Seed-Generator-main/actions/__pycache__/__init__.cpython-311.pyc
- Size 193B
- SHA256 68c3355cf259ca107b47e00f0cc07eae906053da97195631e6b026b712b1ca8b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/actions/__pycache__/install.cpython-311.pyc
- Size 3KB
- SHA256 24f0d9cd41405671dd459733951574338e6b7b542aacef89bbe0038d9347abf9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/actions/__pycache__/settings.cpython-311.pyc
- Size 4KB
- SHA256 8cfaba41c2d371183ad9491b6533910c9699c41619e8935c32f7fdbf2ab8883a
Score3/10 -
- Target Seed-Generator-main/actions/about.py
- Size 2KB
- SHA256 7c455bea199b8209da9374cfecda0753c90f72eeb050df441cf08cc2dd93c2d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/actions/install.py
- Size 1KB
- SHA256 c3e6705605c30eacf1b3fbe064592b69e4bb7a80938bdda6a6a8176538d8af7d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/actions/settings.py
- Size 2KB
- SHA256 7019e276dfe1a2c0b59bd76c090f0e45dd6d4d04469ce95e6bd1affa357b3870
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Seed-Generator-main/bot_actions.py
- Size 13KB
- SHA256 cbeaed46d592145c7c9a5b83920f248eb2a5b66b736b009f3a5723323cb2405b
Score3/10 -
- Target Seed-Generator-main/config.py
- Size 1KB
- SHA256 7c9a96346ae7876a306e88c7476d9ae23170b1308178c3364341975e2f3b4951
Score3/10 -
- Target Seed-Generator-main/main.py
- Size 3KB
- SHA256 8524218797e235956f0befe8c0ff9f3bb9cbed9adf33b288b6d13dfb223e3c48
Score3/10 -
- Target Seed-Generator-main/run.bat
- Size 623B
- SHA256 c2489ec5856de6b3c1bc2c32e3bda1e4e1646b3028fe6418aac1a1462a0af102
Score10/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target Seed-Generator-main/run.sh
- Size 346B
- SHA256 c805586a84cb66c7d3fd069934303e7a1ab7b36378bf15823c0b8bb72d9fbbf9
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Python
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3