General
- Target WorthFall 4.87675.exe
- Size 105.8MB
- Sample260807-ca144sywex
- SHA256 5f2309e0d3b363293935dff0551651eee14c16265f121576db56abd717168553
Malware Config
Targets
-
- Target WorthFall 4.87675.exe
- Size 105.8MB
- SHA256 5f2309e0d3b363293935dff0551651eee14c16265f121576db56abd717168553
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score1/10 -
- Target chrome_100_percent.pak
- Size 117KB
- SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
Score3/10 -
- Target chrome_200_percent.pak
- Size 192KB
- SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
Score3/10 -
- Target icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
Score3/10 -
- Target locales/af.pak
- Size 605KB
- SHA256 d990f4ced39e31a1149d2a1842ce2504706885e6ab05957ee2f338c77d94c16b
Score3/10 -
- Target locales/am.pak
- Size 983KB
- SHA256 8d3d5dfc64acfbb0c35036d74561d09ddf3b22058eeed0f8d26a2e9c0703248e
Score3/10 -
- Target locales/ar.pak
- Size 1.1MB
- SHA256 01f11a2c50a25b12aa99e36d6f38b334179d6efbf073ac47dec7819f88dce668
Score3/10 -
- Target locales/bg.pak
- Size 1.1MB
- SHA256 2789212aac5f2133ed23c1f84623bc64eb4cfbd93aef7af751d1221e27a21daa
Score3/10 -
- Target locales/bn.pak
- Size 1.4MB
- SHA256 e72b72977b40fb10472fe1a3fcffcda8b434bf52e2bb2da2935faa80da224812
Score3/10 -
- Target locales/ca.pak
- Size 683KB
- SHA256 4289d89e86d0394bc545d63b375fa050f3823ef99ebc6831e8b1a28d3a17fda0
Score3/10 -
- Target locales/cs.pak
- Size 709KB
- SHA256 8386f70e830a565d0674014ae4ad385a61eb43d7e7b99d4d373d14388dfd32ce
Score3/10 -
- Target locales/da.pak
- Size 637KB
- SHA256 ff687bb6dc79bb638bca4f6a9226544a783209645922d323cf777b169690b25a
Score3/10 -
- Target locales/de.pak
- Size 684KB
- SHA256 941c4d0ac3de30cdb5922e4bf1423354eca1148aacd3dd71499af3bba1fcea8f
Score3/10 -
- Target locales/el.pak
- Size 1.2MB
- SHA256 3ee2e46a5a569e411ccf9d77ee4f356e1833bfccbaefcc5e71b7c1517206ab5f
Score3/10 -
- Target locales/en-GB.pak
- Size 552KB
- SHA256 aac3b4904d021d58d053bdea2d8056a219ecda1e341d87cb70070aea2cee418f
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
5System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
4