1f95c74207f11cb05a15b88d5c0ee8edec4543b3de844a8f3f99ae7f14e15c73

Sharing

Copy URL Twitter E-mail

General

Target
1f95c74207f11cb05a15b88d5c0ee8edec4543b3de844a8f3f99ae7f14e15c73
Size 8.0MB
Sample260801-cmzrtaca83
SHA256 1f95c74207f11cb05a15b88d5c0ee8edec4543b3de844a8f3f99ae7f14e15c73
MD5 b84fac820a9706e802a585e63972527f
SHA1 65ea87fb40f75c7988c5a35ecc27291198a96236
SHA512 b8a1093e9b5dbd5de09eef0ab5d06eecd31af00bc46c4b972a7048da9293e044f76515191158a6cde236b0c9a639bb5ccb3d383bfddd0ab563b1be34b6778f09
SSDEEP 196608:PuDENCIKgwt6iUGw4t6dl3Qekrt/VDYjvtsnvXr/wjjTl:uENCI6V3w5d7kJ/VEjFsnvSl
TLSH
T1E98633F272F92991FB55BFFB47E15807221A88624D4142EC9407333DAA22BF5691F4B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Installer/DW/dw.exe
- Size 3.3MB
- SHA256 efbad53f80d4b914b1ae716045b2451b1e3fa7b84a45f0c0496e5eef8fe5b465
- MD5 ca7daa207d8aa55c1ce22b4b6e41f3f8
- SHA1 de193aafd9a03d22423ada4d76a8ea67bf4285bc
- SHA512 5698e2597f294b39a2cbd47d497d8198b044ca9e154d3cb4d3ce1f019a6ba774d7572b57f7fe9ad372d5d742350ca658c0ff8b84eb1ccf5c8c57eea7eea44f09
- SSDEEP 24576:PkUdAtlrqh9Sx2wLqvJ+26c+m/JoGHjbp63jf/72ZKMldzBeletrKDX7jQYRD06B:PkUdAHerSx2zJ1T+KJoWd6jjOR85bEk
- TLSH
  T1D5F56B07BCE059E9D0AA933189B652527B31BC084F3263DB2E90B7782F727D19D76B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  Installer/Installer.exe
- Size 3.5MB
- SHA256 5535bbcc929424c0394cf2cb4a9f2c3e6a1c2892b7d5402fd0376c880bea89e1
- MD5 1525140cae2b86116b2350a05870cba6
- SHA1 a37fbc33eda660b58ae81d821ba7262f078c2dd1
- SHA512 66e813c8e60adf89b2e08eb357a056bfadbbc5c240ed8f683b0e35de958c4a8311fe7c0f30d449b42bf123e08ff08ca443703e28d422115e019b2e386adbe1b0
- SSDEEP 49152:1q0DzXQxDc2f/+Y/Eyp+BDWPiHHcRYZNh:1rxyp2FHcR0h
- TLSH
  T105065B07BCD248E5C09AA33189B752567B74BC084B3227EB2E90BB782F727D05D36B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  Installer/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Installer/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Installer/localdata/Serilg.dll
- Size 125KB
- SHA256 db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc
- MD5 181f3e3d0c509566283156816eb317ca
- SHA1 400debdd4fb9ae24719157132a87c4bfeff7fa6c
- SHA512 039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667
- SSDEEP 3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa
- TLSH
  T18EC34C2863FC9EA1CBEE75B5A0B081810B74FC9F6077EF8E695C25F91D123094A60B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Installer/localdata/SystemEx.dll
- Size 23KB
- SHA256 a78c4d08c6726e1e560c3a47436c631847423cab95032d02ccd4e10f92e6d937
- MD5 fba0fc7ec66d149d2096ab7032f751c5
- SHA1 e2d9f46a045235548ae4d648de1d317b71531b5a
- SHA512 124966ca2827b1d11d8e49dada8e5a708047e6819fac6031d5f83150dcbad0b2935bb630304e4589845b22ce22665796c9987bd343668345875143b44f80d342
- SSDEEP 384:TZucmhNHUrP0p/gN9ro7zjLIYiVTAM+o/8E9VF0NyJWQI:8LN0IgLE7X0YipAMxkELI
- TLSH
  T117B26E0A9F489803CA5F5A7070D5532AC230F69A6BC2D7E7369CC1359F4338639E63E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Installer/localdata/bin/shellext.dll.mui
- Size 3KB
- SHA256 965d0e8e10aa6b54143ee53fdddab4d741c6d98d25d98178b952ce59525fc38f
- MD5 efc6c0bdcfcc4855ffaa417c21dd974c
- SHA1 09ba48ecfb36e41e5c6cd15a26f2107b5a306e4e
- SHA512 2a69e0bf20ab668397a6d1bdeb4dff03156360eff00dec42b898e03174509de8ac05adc384db129a17e05d6d3f84b4fa82fc93331b37dce83ffd8527138c6456
- TLSH
  T1AC71A10F9BBB4117F0A65B304BE745C227BD7E137392A56FCF0A142924641386A90FF2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  Installer/localdata/dll/libasset32.dll
- Size 8.8MB
- SHA256 c127f79b4996890a01986f88b4e2076ff7cdb8b6de01092c548b3f28aeda35dd
- MD5 ec1498f406642076468424ef2f45c452
- SHA1 4ab87728753c802273ad96f5567ecabfe1274465
- SHA512 df23385529ccf209478ab64756971e242caeb6c9157605bfc4c8b77bbc8af588f54c90b9fd3814372dd7f226edffb4425516eba296881ef5230bb5a9d591f60a
- SSDEEP 196608:4L7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wKl3bc2EeJUO9WLcb0T:ylOJDm1Lrc2EeJUO9WLcbU
- TLSH
  T1CF963951EA8B58F5EE936B70818BE33F5738AE10C532EFB7EB08D529A8335C21905751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  Installer/localdata/dll/mfc140.dll
- Size 5.5MB
- SHA256 5e62691bf7275652019073c2d41f3ac50116f4dca4b73d52aed4708cc557627a
- MD5 5e9c970ad0b02973bb082349a051e14a
- SHA1 294efe32d7585a434c48876b6a82061054ace070
- SHA512 e1b287b3a818b6304d37e5e8265a5779e39ead3985f0edbd95ec427152901bca3fdb473c80ccdaadd4f381f3e47aa88707f6924e40bcad908f18a314c6a33168
- SSDEEP 49152:9D4hn6nlxf/48dzk70ogp4HjGXSBG378h/1Qs0Fz0+vULJCuSwIbFLOAkGy3zdnk:zKTWULYFLOAkGkzdnEVomFHKnPU
- TLSH
  T10F467D46BBAC4494C566D07A866F8E4BD3B3FC50273157CB0026679E9F337E24A39272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17