Extracted

• • Target
    beyond_the_skybox/beyond_the_skybox-1.0.3.jar
  • Size 150.9MB
  • SHA256 c3f909ce7b419dbe9d5879a087ba47ffb0290ba189a18255a15b4aa9b9b92436
  • MD5 4a69cf278ebccb40a9ad7d85a61c966b
  • SHA1 ddf7c7ad15dd99a4afc2b3cbc5d833fdc840ab87
  • SHA512 3f5a2de91a9e0203e642266d7b9cefc2b0bf5f1182fc79708f467016435d5f2c8981018e3dfa9b512719c8975624f2c96ee785c738b165bdb3c29c5dfa7b377d
  • SSDEEP 3145728:iyoA8NzFLFduPBVxgm7dLMDVaJrBqMjlsTIOxGwFR1r:iygNFLjiBVxvLO8uAxwGwF3r
  • TLSH
    T1FF78338318FECF483E5D1484786B2DC911C556EFA3AEBB4E7FFF8A1426C2D215489219
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    beyond_the_skybox/install.ps1
  • Size 1KB
  • SHA256 0ccc2b2582bf7401924554e504fc0acf15984fd34cee25185e61b0295930a736
  • MD5 97672c58e84db46e120204a2eb8fa345
  • SHA1 166f483f425c6179c15962461b043cc9468adec1
  • SHA512 3a5c1429071ac12c8e1322a990baca4d903d2c80d54bd6fec42469b6fa50640e6fd5247669009d839180f4e60b97c971ac4e0b2442c129452d594ff4b1779976
  • TLSH
    T1F2312972193C91E18D52818726DB3AD704F1C72809C16CC9F08E4A809F7CDED49BE0F9
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionsalatstealerpersistencespywarestealerupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4