24a5351cd76ca1cb41f37e4c350ab9c7cd9fa4a206f3e6a73d9547671a184c00

Sharing

Copy URL Twitter E-mail

General

Target
IsraeliAuthV3.zip
Size 22.2MB
Sample260810-a6lyysybld
SHA256 24a5351cd76ca1cb41f37e4c350ab9c7cd9fa4a206f3e6a73d9547671a184c00
MD5 e44817657857556bed184e85879174cb
SHA1 0c602973be0e2f757de62dddf453afc9642056fb
SHA512 666b3f9f7664b1e4d7704557d51d1baa0728effec1d7123f8ca3d73c6a8da860ecd88a990c3dd80c750f9b61b4c49f3cf98d9ce90e1c310ef1b392199352b8bb
SSDEEP 393216:ZhvQuH3YdLovJfiOkcKbF9MUf4Rdp0vQuH3YdLovJfiOkcKbF9MUf4Rdp1Pq:/PH3ILovh9kFfHf4GPH3ILovh9kFfHfV
TLSH
T14237338EA2C22C17EC0CB3C93BBBA5D662C9D7642C6798B42947A33D7FB551544368CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IsraeliAuthV3.zip
- Size 22.2MB
- SHA256 24a5351cd76ca1cb41f37e4c350ab9c7cd9fa4a206f3e6a73d9547671a184c00
- MD5 e44817657857556bed184e85879174cb
- SHA1 0c602973be0e2f757de62dddf453afc9642056fb
- SHA512 666b3f9f7664b1e4d7704557d51d1baa0728effec1d7123f8ca3d73c6a8da860ecd88a990c3dd80c750f9b61b4c49f3cf98d9ce90e1c310ef1b392199352b8bb
- SSDEEP 393216:ZhvQuH3YdLovJfiOkcKbF9MUf4Rdp0vQuH3YdLovJfiOkcKbF9MUf4Rdp1Pq:/PH3ILovh9kFfHf4GPH3ILovh9kFfHfV
- TLSH
  T14237338EA2C22C17EC0CB3C93BBBA5D662C9D7642C6798B42947A33D7FB551544368CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Debug/Israel Auth V3/Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
- MD5 ff34978b62d5e0be84a895d9c30f99ae
- SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
- SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
- SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
- TLSH
  T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Debug/Israel Auth V3/Microsoft.Bcl.TimeProvider.dll
- Size 31KB
- SHA256 1c5a3d263b723ecf05a98d9bec4e59c476d553c75e912dfefb3e137671b7be72
- MD5 d26ec836e870f3a0c1f85b44f946bbf7
- SHA1 3ef723e1d763fc58deb02e7b4a15924ddb1d59b8
- SHA512 68870b0e0cf82511a07d534b904eed7520f5573eead99faf4532b76378de395503604fe17822b28891e8bc34f784350b70a3e5b478c877dd9bc7962a06bac763
- SSDEEP 384:WUF909jkDz0MVW2AevTJbdaX99JsNP3G+zpQWhzbW9Tb2HRN76tKlO8R9zexD3B:WUF+k8MVWsTJbdc9r07G/iNOQ9zs3B
- TLSH
  T153E26C52C3AC4317EEBE1E71A8F4E1421976B3967813E73E1A4DF0462DA7B406A20F75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Debug/Israel Auth V3/Microsoft.Extensions.Logging.Abstractions.dll
- Size 46KB
- SHA256 11237735e84a15e786a3cb807e3683965e371937f02b53de5edcd95b96f6dacb
- MD5 071af169726a1386248d60084561bed6
- SHA1 655b525bf733af9f1ff7a7898e98116347e67cf8
- SHA512 c73be2eb20cb01a4a1100f13948d2c330dbdd4e6ca3659a9e2b1a95fc0bd044837ad6828c8918dcbab3a80baad763518f5d7d8f3755a669e43f1ad9e16d3206e
- SSDEEP 768:K6+Si2RFK9jSq43+EDM+cchB+wTStirCjn11L/KV:IO+E4dc3N2t0CT1FSV
- TLSH
  T176235C05A7EC023BCA784DFAF8E492816B75D1D32C02CB4B9CDCE15428A7BD95E5172E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Debug/Israel Auth V3/Microsoft.IdentityModel.Abstractions.dll
- Size 19KB
- SHA256 48bd29fbc18ee81ba03b93dba512561aed287e577a24a8dbf278799a3b8847d4
- MD5 0e73983bddfe375a0f7520a1c7ad750e
- SHA1 303a2f3847a17d93b89be51a790aef7fe5351d11
- SHA512 ee9942a3f0384136dc9a7e5dc6ed94a657bc7c5b206288fd219139aec858ff8f0687bfbea11cb8fcbd90358407c6aef03537675619400f00b5238a16016e923f
- SSDEEP 384:gw+9Em2OIyQ1VY6kwzWdooW3VHRN7/FbR9zRxu7/FoA:g6l7ZkO11r9zRmOA
- TLSH
  T11E923A95CBAC8243DC575B31A6AADD432E3CABD69910D27E038CF54A1C137C9DA3123E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Debug/Israel Auth V3/Microsoft.IdentityModel.JsonWebTokens.dll
- Size 165KB
- SHA256 608eeadae79660028621c3d4057c190d266adc9722e143a61b4cb79cc334af24
- MD5 5694a8f8f664fbe12b494ba155e396f8
- SHA1 20fdcc4c05822bcfb94e9a3c1e94374f7198bb54
- SHA512 8afb5448d650e52083df8a62ac9c20fe49fbad177392ffcf13afa77bde53998d9d88dc09d41f1b63f877319a6b86b310eedc94b0cba4c1e35860256469bcc424
- SSDEEP 3072:mFFfdLU8mvLVchDZKzQklRNiY6h0z66irWN9XNEgfpXaXr0iMJgBGILkDzVZl0+w:m/GLVcRgz7NBir0aMqxMvMZ
- TLSH
  T1F5F3181423FC4748F4FF6B3969B451104EBABE46AC39EB4C2CA195DD1862F809A70B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Debug/Israel Auth V3/Microsoft.IdentityModel.Logging.dll
- Size 38KB
- SHA256 c3759bf8d29c5f0c5ccc06f038764bf03336c92c199279411bf8fac7013c7c47
- MD5 003511dccc1b4dc8acff51a445cd9da8
- SHA1 3252f93228c147a60634fea228dec9a89689031c
- SHA512 8c628705209f21d46163af104d7fdeeec823487b824005cc7116086d0bae41a76c39af511b8734b5f806c60de55ef8800b72f1aaa65d158021b47b94566dc3ae
- SSDEEP 768:mdoCQV5mZEwjYeh6ItDFUwYQgZRYAVcTq+2YsULi9zY8:qSVgoIsDsAVOj2Ys1zY8
- TLSH
  T11D036C1153ECC366EEFA1F30BAB599121A3EBAC37A21D74D2954E14E0D03BC54B10B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Debug/Israel Auth V3/Microsoft.IdentityModel.Tokens.dll
- Size 382KB
- SHA256 e65d85deb269158b983046d0a73c152ae95e70fd2a5ae1b4200310f9e61ed23d
- MD5 276516ba010a7ece7da947b85fd28cae
- SHA1 50b36758049ed1bda4e79f56c12c55d5a9b71537
- SHA512 4b7f02c4a4fefce6d7ce3b6f8c1689977b463607b19a65b0aed03ec1a9b13c9af588f9b1819e3b1249e1d3f73792d22087588f44c7e83149c7d7797936a9b4a0
- SSDEEP 6144:vHPCCDKYVK8MS+Om5SrEdoO4mEqh+zDLhbqt/IjoqxcX1PuEWD5fb:XFH3lYYu4mE75
- TLSH
  T12D841854A3FC825AF1FF2B71A9B915154AB3FE4FB8BAC75E2250D11E1C22B409860737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Debug/Israel Auth V3/Oculus Auth.exe
- Size 10.8MB
- SHA256 7afaafdd8dea7a6a762338f9ae46e4133486c5c43f9e772d95442b9cbc43d553
- MD5 c8c7ecd3e9a7b080abce67cfcde83a96
- SHA1 a36ace241657ea67695aabead1fb6d4a9b9bd395
- SHA512 cd6285b9c4d290c55d2665c78dd20013bbbc42d71d120b0d63a21647f8e45305e4f5420a9f2831c4019d6bd0b1b25e63cec3514ebc67a25d874c593c64dd672c
- SSDEEP 196608:OhsqlGN6XLK9vrsW4gXySntTFqq8N3tVh86A+OMTI8ZHsGXRrYBpXFHIE7E:JqnLKlrNtZq5Xj86A+71ZHsGXRu7Hu
- TLSH
  T1DBB63359A7C018A7E8A7627C96B3C546E2E2B5361B22DCFF1791433D2F731D0483A69C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral17 behavioral18
- Target
  DemonZ.pyc
- Size 40KB
- SHA256 66ca207fd8b65e4015773076f52e13e4e11fcb0f681b38ce83541f2c641aeb3b
- MD5 f5040fa4bc3fa492562aef580697fd0a
- SHA1 db1841a587dd75fc68a1bf2af0f3a436e1fa71a1
- SHA512 4ffc9638ccfa933c5e02865cb7a51f8f18a9d60f153edd5c244d86be0d12198d46394dc5b8103a34fd7ca62ba50d6a4ab55f266669afc869fb175a04a88e8015
- SSDEEP 768:X+X9DY4WezL4GmZoXLPn/nHXSTfoGjsKflc04R9FF:XcT4GxHXq3hu04RR
- TLSH
  T1A4030AB64A54B427EDC9F0B831E1D984AB71C2893250D743F518CCBCBCCD654AA5A71E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Debug/Israel Auth V3/Steam Auth.exe
- Size 10.8MB
- SHA256 7afaafdd8dea7a6a762338f9ae46e4133486c5c43f9e772d95442b9cbc43d553
- MD5 c8c7ecd3e9a7b080abce67cfcde83a96
- SHA1 a36ace241657ea67695aabead1fb6d4a9b9bd395
- SHA512 cd6285b9c4d290c55d2665c78dd20013bbbc42d71d120b0d63a21647f8e45305e4f5420a9f2831c4019d6bd0b1b25e63cec3514ebc67a25d874c593c64dd672c
- SSDEEP 196608:OhsqlGN6XLK9vrsW4gXySntTFqq8N3tVh86A+OMTI8ZHsGXRrYBpXFHIE7E:JqnLKlrNtZq5Xj86A+71ZHsGXRu7Hu
- TLSH
  T1DBB63359A7C018A7E8A7627C96B3C546E2E2B5361B22DCFF1791433D2F731D0483A69C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral21 behavioral22
- Target
  DemonZ.pyc
- Size 40KB
- SHA256 66ca207fd8b65e4015773076f52e13e4e11fcb0f681b38ce83541f2c641aeb3b
- MD5 f5040fa4bc3fa492562aef580697fd0a
- SHA1 db1841a587dd75fc68a1bf2af0f3a436e1fa71a1
- SHA512 4ffc9638ccfa933c5e02865cb7a51f8f18a9d60f153edd5c244d86be0d12198d46394dc5b8103a34fd7ca62ba50d6a4ab55f266669afc869fb175a04a88e8015
- SSDEEP 768:X+X9DY4WezL4GmZoXLPn/nHXSTfoGjsKflc04R9FF:XcT4GxHXq3hu04RR
- TLSH
  T1A4030AB64A54B427EDC9F0B831E1D984AB71C2893250D743F518CCBCBCCD654AA5A71E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Debug/Israel Auth V3/System.Buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Debug/Israel Auth V3/System.Diagnostics.DiagnosticSource.dll
- Size 164KB
- SHA256 adfdd696119a96761d680c9b30ef8cf908bf45088321239b3eb377d6947af594
- MD5 ee6b380545b6d5e821b5f1387a55765b
- SHA1 c706908f1f3f616bd6f4134d110d167f694061d9
- SHA512 b74da845b49b64c5397d778f84c3f287cd491bee0964740528893b360f10e005839e7c1ecbbb74ec596428d66ef86f7ff9a694149fbd0d4fd16e585b0874b4ce
- SSDEEP 3072:9k9Qguh0HTe6oTVr/NEFWARs228VIQKw+EOFEZK:9Muh0KrZY74SpL4
- TLSH
  T1A9F37C1163DC136BCEEF5675F2A488464B72FD4BF616D78E2948B9FC2863780CA21253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Debug/Israel Auth V3/System.IdentityModel.Tokens.Jwt.dll
- Size 89KB
- SHA256 2e3603bc1ca6a3b31019ee12b88ad6dcb5c3b08a245acd9749279a1caa73fade
- MD5 db58193337fb5a93f440a2a60840acc3
- SHA1 07a4a55905130d25498f90112c4567bf8263f6ee
- SHA512 763430964777bd7968d08c0faee61df768ff676eb1cd9d4b41e7369ae5670db521e380c1d0bb345daa375a57471948f61242ce743596c85f43aa0568e7649cdf
- SSDEEP 1536:OEbJakVZLxCP0sDGVWB8LZuOzpnqk5p/rqXTqA88V1xNxqx+231ze:n5ZCKVU8LZuOn/rqXTqA88V1LO+G1a
- TLSH
  T1B593191077EC8329F5FF2F39E1B190401AB5BE57A839DB8D1980929E5877BC08A60777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Debug/Israel Auth V3/System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32