832598b4fa84058a438966ffc8214f49fbc246e6478f483eccfcea70fc45b86e

Sharing

Copy URL Twitter E-mail

General

Target
VolcanoExecutor.zip
Size 32.2MB
Sample260802-heflvsvvcs
SHA256 832598b4fa84058a438966ffc8214f49fbc246e6478f483eccfcea70fc45b86e
MD5 8ae909f771704f46a631d185092a5059
SHA1 51fbb78f799c841bfa6245dfc59b15955689af2a
SHA512 6ee21cc8ac807f13a3ef37b040469192645bd803375ece692fa39ff843409b00aaf0e84a16b97b3be01a4ca94dbc344375e1e081f08fd1472420a0c7dbcd07cd
SSDEEP 786432:kWrb4QijYkhO/Pq2zXXaT1G6MRPZOfsl1igzA+7cQmXl8GK:kWX4QixhgJSMRjbigMQcQTGK
TLSH
T19D7733F791CDA778E4DB77D0AE0304108CA1A532CA2A01A7BB93856455ACB7F6DB1C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  VolcanoExecutor/VolcanoExecutor.exe
- Size 2.4MB
- SHA256 6338d76fb8584b3c01acd3e54894a18acdc4991e27cb0ef38bc813048be0426c
- MD5 11681120205a14f8173a4dd80526988c
- SHA1 f91e610277bdf419b6d6a0c504f995b062e7f355
- SHA512 bfd7be6cd25fff773cee9d59c1fe022b5845791428c49f8c8429a7f26f1bceae570a05fd4f851f92dbeea9f8511a52699880303fe2b18e5c59937c1e0bda3e06
- SSDEEP 49152:/odiePhExLauAMPjZ98wotnCh20QlEL6/Ewvl4TxsaNFc5WgkwFI:/Oh+majM4YELDFzrCI
- TLSH
  T1FEC52917E2A360FCCA6BC134865BA772B971B8580130BE7F5554CB302F71EA0576EB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1
- Target
  VolcanoExecutor/libiconv-2.dll
- Size 1.1MB
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
- MD5 ba98508c9c8fb1681193aeffdbfa535e
- SHA1 789489f95afe79a531373099336310707f0199ff
- SHA512 992c8dba9e2a76bc8dfb2986d637c9005d8e607631dc7a9b5d16597b741421d3c287a1be27a885dfe360ce46e5f4b4b4282c18aa2f4582264ea285d993cf994e
- SSDEEP 24576:fyRg1BAUZLY3wPKo6VbbTOZGavkg3NyeuQ6l9fH+ftFHo:6Rg1BAUZLYgio6IZGaXBuQQ9etFI
- TLSH
  T10535BE51F3D2CB2BF263C6B0C9AA5B26E427EC216B0645337660B3BC5D33BA415C8566
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  VolcanoExecutor/libintl-8.dll
- Size 301KB
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
- MD5 83f4bfec7f089f4a9efd5b36690b6cd7
- SHA1 8f9b913c8c4724c70eddab906fb1465e4fcb0dbf
- SHA512 43a4049e6ca85b90fe9b325b301b6c23d94d2045e0b218b0d0495c539ec22c6f43b2f4fd589b77b3945d0f9f2938e84db9c534aeb79fa5b929102b0c6eeeb20e
- SSDEEP 6144:DqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJB:6WcOXow+8Wmiwd+TuoJB
- TLSH
  T11C642907B24395D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E329515B19B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  VolcanoExecutor/libpcre2-8-0.dll
- Size 711KB
- SHA256 413b0fd931d5e98e0fc70bb37d33c7aaca9d4a2b0321ec6060bdd716d80dfd92
- MD5 8a360488bff85ff1da8ab57fe40df98b
- SHA1 0e841e0fbe1f3245eafe0fac26d75862b83f0da4
- SHA512 c6549584035244e0cfa9ce36c02671fbda9482268d02f1c450e65653b9e434323569113c5a403a6bb3242b10aef599d14c4a6ba88865d6b74279e09fa2909b43
- SSDEEP 12288:C/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUWu:C/Cy7BDd94/6sEXI3fmjFUWu
- TLSH
  T193F4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3312E139216A5AA1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  VolcanoExecutor/libwinpthread-1.dll
- Size 25.6MB
- SHA256 852030540e77516fcad10c3f639c07b6fd8ca05887099e0d63783edda0a24102
- MD5 937d7286d78f18d11a5149cba0029811
- SHA1 46f692dda770127a22bfe7b3a7243cdccda31543
- SHA512 46008f10538bf570ae50d47670a6117fac650b5b9b654adfef216f85a15cb01cbd4fe5f791cca891a982abde5927861641ce11a1c1b56f1062231688d09bc24f
- SSDEEP 49152:2eimu4U5R7Z89h6CYzNHUQ9I69Z1tzSeiVdTfDbz29VAJgTmc1DTYPQTUCe:22SNF9lSeiPjXMiRPQTUCe
- TLSH
  T15C47D034E39911A8E527DA748A61A233D771B4060760A7CB0E9BF615DF73FA09B3B311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral5
- Target
  VolcanoExecutor/msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  VolcanoExecutor/ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  VolcanoExecutor/vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  VolcanoExecutor/vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  VolcanoExecutor/zlib1.dll
- Size 128KB
- SHA256 49dea0fa4f407054ff10b459e8dadb6443cc0ca8aefcd19d9864dd0423b27501
- MD5 189289e121629c125a1d1e8be51f0324
- SHA1 f86ef2fe11269fd45f7c5d8c4b523ed8e445b56b
- SHA512 9693347fd0bf9c6d05c288aa09a892368b32d4c2288ed74dcb62358787f034465c17ac5b409dfeb261a7055bf6b2d9479ba03defbcd39c50caad1dbc7e8e3dee
- SSDEEP 3072:Ljf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3/Fb1:fLCbYiBp1LghAxG9BI6LH2F3/X
- TLSH
  T1F2D38D9BF8A265E9C6B7C17085D78B72F930F81106746EBB4258E7742E22F405B1C2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Suspicious use of NtCreateUserProcessOtherParentProcess

Loads dropped DLL

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10