e45d149081b2f65cee27d6a038afe1ff9b5c89382a935deadc6faf7c45d2f215

Sharing

Copy URL Twitter E-mail

General

Target
Temp-Spoofer.zip
Size 10.3MB
Sample260809-1glj1ay1ds
SHA256 e45d149081b2f65cee27d6a038afe1ff9b5c89382a935deadc6faf7c45d2f215
MD5 9a39adc580c206bcd71bc0df84a3c06b
SHA1 970c9878001bdec27a7b0eef0e1b981b65341c15
SHA512 a72d80975ee0c0375ebc91218538650c8704faeb085cf4521c59a97dea30cbd863616f312c18e03325cd34ad336eae7626e7a1fba2a0918583c4eed22520fa97
SSDEEP 196608:XOVt/acm9+F6ec7rEirYVRBzhn/+XSUHrwzs2IZBTztTemb6K:Xi/ac+dYYYV/JWCRsRTJemX
TLSH
T1D4B63311E84842C2B0DDDA72D28F8E786C3B69953D7189A0C66C933D1BCC9F5F6FA116
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Temp-Spoofer/TempSpoofer.exe
- Size 8.0MB
- SHA256 6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a
- MD5 53648dee77c997e3665a8c3add00eeaa
- SHA1 dfeedc4eae6c517ef1286bd041cc36de8a608f46
- SHA512 598afff16262ee75f9866a62a124407c6ef5dff8c577371ea79ea8817805be998ba6d0553497400312c1cf5c0106772696727f312bd55ac99a8c23dd6e138f65
- SSDEEP 98304:V3T2h9PPeJzgg3ty1qrMGUjEBoSMeduU8gsHZVY/YK2:VjigJMg3E1qwQFM/U8gsHCYX
- TLSH
  T1FC867C43EC9159E9C1A9A33089A79253BB71BC481B3223D72B90F7392F76BD06E75350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution credential_access discovery persistence spyware stealer
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Temp-Spoofer/imgui/imgui_widgets.cpp
- Size 398KB
- SHA256 c5411fb7b51416995e97478bbb2c77ce752090e41ffaed6aa401936247494cd5
- MD5 4c861b508d279476cabe905125f9f22b
- SHA1 21c66b34182e7a9cb3e9ba19480854ceb622d3a1
- SHA512 6f3b9edb38a124670764ccca43adf9c5be86dc23fd623b33bf50412125bf9782ff69a4a558e1fac5e5dbdc66b8f647c32a7306096f2afd91dc05b06a2a9e627a
- SSDEEP 6144:mTSoo34Q5XfG21IV+gskMM2MpwFWk1O1EU:mTSoo34Q5XfHwMM2MpYWk1O1F
- TLSH
  T1E194D5852D1332268A33E0694FC75255EB3958773BD4C9A07A1E635C7F8043682BDBEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/net20/Newtonsoft.Json.dll
- Size 557KB
- SHA256 500eb5560aae4d3a4d7dc4c61a880906ed0231f1a636113f74778b86eaf979b1
- MD5 2c41a312a9fb88d4d941af966b91510c
- SHA1 488fe552cec6c1eebcd87f13061276bb09f46469
- SHA512 ca4d6314c684df6684fbce099b6ee3cbd0a53a64110e5c996cda13bdd67aa8659bfb4ad806c5509bd6d6f3aa90f1bcda917a62754a78a734cd1d2f9fd08f56af
- SSDEEP 6144:lU3Xko42dAQX23EkyF/D2twQ+87e4YWOXoyRl/2uTkVal/BuCia/WAulFh:Ck3g6EkR2g7eZ9R3keBoAuZ
- TLSH
  T1E1C44B8423FC9B66EAEE5776F434055857F9F81BA176E74F9684E6B90C83B804C007A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/net35/Newtonsoft.Json.dll
- Size 493KB
- SHA256 7beb6a951b92af14322a382cf105fff8d0dc63518b33556b98e09daca0cb6d07
- MD5 1390b082700afc53a7aa320f3259325e
- SHA1 8f72572ad084ef145fd3286930af6b70ba622384
- SHA512 ace3b9548bb8d29805673ac4611a141e4c026c5d09a63bd399f904d28ea274f9e0ff682b99adce25a66ccdd7e3f03e0a45ca9ae0a67e88d9d1c83cb34180b8d6
- SSDEEP 12288:ZmKLDa2Tqte5+7OWpP8gkRCj7gBEA+PeKjJc:Die0/pP8gUwcBEAMeKdc
- TLSH
  T1FEB4191133FC8F15E5EE2732E4344925AAFAF457A6BAD74E694199BE2C937808D00373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/net40/Newtonsoft.Json.dll
- Size 560KB
- SHA256 f1f01b3474b92d6e1c3d6adfae74ee0ea0eba6e9935565fe2317686d80a2e886
- MD5 8f81c9520104b730c25d90a9dd511148
- SHA1 7cf46cb81c3b51965c1f78762840eb5797594778
- SHA512 b4a66389bf06a6611df47e81b818cc2fcd0a854324a2564a4438866953f148950f59cd4c07c9d40cc3a9043b5ce12b150c8a56cccdf98d5e3f0225edf8c516f3
- SSDEEP 12288:ZzfhypmNGgHA37YyUD1AboTf3xnpJbC8VGSBJjRuz7:ZoI1AbQf3xnpJbC8VLBJjRuz7
- TLSH
  T173C4182023F89B1EE6EE2734F53045285BF5F897A6BED74F5D40A5AA1C92B418D403E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/net45/Newtonsoft.Json.dll
- Size 683KB
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH
  T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/netstandard1.0/Newtonsoft.Json.dll
- Size 653KB
- SHA256 90bcd0b2d3a190a885218d44edb6434a431b0c85ba992ba753657f3319bef06f
- MD5 a54b7154ad22f506e27fcd5313c25914
- SHA1 55ee4f0e7c24633ecf1e26cb85e2853fded03553
- SHA512 c3ee26810062255be9096eb2976f13092f1ddaadc572e8de2d8bdaca4ba8a622d11e7e30f6172a358ec01eb3370b86425b8534bf5e4a8b9df02e6c9f2cbd973f
- SSDEEP 6144:ajQLu6eR/8HEjm4y3QggkYZs8xdmkaC/L1LiKHxo/SKpzxRGZz53YWDkdBMVy7WY:a8ZeRtq4PIYZ2ooqAkfY2da2AWAl
- TLSH
  T1E5E44B0023ED9A17E6DF537AA0B44A18A7F6F426A37BEB9F4644D2F92C837114D40367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/netstandard1.3/Newtonsoft.Json.dll
- Size 671KB
- SHA256 7fb7842edcf315f09b9bd3d3664454148562f09d5cbfb1f2e64de914dc4c8a60
- MD5 35ed5ebd574d619b52041dabd496c632
- SHA1 05c08405fcdc423eedf85d4a6db054720e3c4544
- SHA512 8ba72977b84f645e230d1b1bc6373c3051d993add7576825ab31ed4b2c0e28df5e40842ca190d38dae95f28599a93d366fa06c671e0c812cf7dc1c9d7d8ae785
- SSDEEP 12288:bFGG5+vT3hQ0zJjVNKHuTZDfJLjmQDCB5p:gGiTJzN7TZ1LjxCB5p
- TLSH
  T135E44A0463F88A26DAEF6BB1A5310A294BF6F867D3B9EB4F1508D4F91C877405C447A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/netstandard2.0/Newtonsoft.Json.dll
- Size 677KB
- SHA256 99177a4cbe03625768d64a3d73392310372888f74c3eb271cf775e93057a38e6
- MD5 9454ae6eb0c6ad77e93a95074ba29266
- SHA1 df83fcb3639596ad42d5be8314ef9d672079198b
- SHA512 8d1d2bedde2d5f33179560e1a4f72206ee1984b3f5eb96e93f94329c4c4a8044dd74d62f9e708293132de8c8f351f0e7fed74a450a251a8ade205702b29d9de1
- SSDEEP 12288:SW7laYjrY+5lqoa34DOyPsoD2AgBSjq13P:xP0iqoi4DpEBSjqVP
- TLSH
  T1FCE42A0067FC8B17D2DE93B9B9304D0646F6E417A3B6EFCF990899A91C93B509D413A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/portable-net40+sl5+win8+wp8+wpa81/Newtonsoft.Json.dll
- Size 457KB
- SHA256 b2ecad4214e4f033387284edfa345dbf119be82193ba14f5373d1532d13adafc
- MD5 d5178a9a304c0e069250584352b2ffde
- SHA1 7f882cdf5d8bf4c9cb778d7e4f7acc6898daafdd
- SHA512 21eec59addd91393181503c0d59e5904a12318f68d3578f52f4479253a5038b144e8f78420ecdfc94ea5b2e6c3af969028b1ec6c3f43a788ab603ace54927d73
- SSDEEP 6144:12GQyV6/vgHVeM50fIiHWzFU8atXySolOQv383n+GcRYYalZ+sYd5A8QNjUdY:12GQFvVO0VV9VQvM3+ZRYkA8gS
- TLSH
  T16AA44A5063FC9B26EAEF5735E0304905A7F9F467A27AD38E6984A5BE1C43B509C007B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Temp-Spoofer/packages/Newtonsoft.Json.12.0.3/lib/portable-net45+win8+wp8+wpa81/Newtonsoft.Json.dll
- Size 652KB
- SHA256 bfa3658d682a2fc64456bc3df44129db122f5be256d930c06c39474b7d108972
- MD5 5132aa8a39fd5a53ff491e3931d2fc0c
- SHA1 5cfe9782649c73e704cac00cb6b3d99e409bd80e
- SHA512 5a0a0cf39dbe4a4488c6e564f7238e78d7fb8759a06fb0160f6b5befca50ad216d8212b2eb6628559c2e9ef450032043971dfdb9ea2767a988e0428c6eb40a30
- SSDEEP 12288:4mg+s4QIqDCWk8bhhdngX3X3X3XQMsATXO:VoIqDC58Nh5gX3X3X3XtsATe
- TLSH
  T1E0E45B40A3F89A17E6DF9379A8300E1D97F5F512A3BAE75FA948E1E91C837114C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22