f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c

Sharing

Copy URL Twitter E-mail

General

Target
f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
Size 11.3MB
Sample260810-caeacahj5x
SHA256 f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
MD5 52300c8d335f26bbbb4b0d60f89c021b
SHA1 219728756dff35d62dac58bdf5878578f07e1dbe
SHA512 b8114c24f25f92ee5104bbef83b2caab4e3849dfd9e7db1e3b22b19ca87b66ae9050fbc2b0213f4e846d082505fcead1b3bd6948a09cf9e8c6a3466fb755acb8
SSDEEP 196608:FY9/ini6U74pjhCtosK7EI/zaBpJrLoa59/fPeET22Nr+pA1Iflx9bi08At:F46UUBhMPkZ7UPHoa5lfPeEl+pAv08At
TLSH
T118C633484FFB691A299A89F431BA31129613B7C70C686376A4EDF40B7017BC4C85EF5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
- Size 11.3MB
- SHA256 f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
- MD5 52300c8d335f26bbbb4b0d60f89c021b
- SHA1 219728756dff35d62dac58bdf5878578f07e1dbe
- SHA512 b8114c24f25f92ee5104bbef83b2caab4e3849dfd9e7db1e3b22b19ca87b66ae9050fbc2b0213f4e846d082505fcead1b3bd6948a09cf9e8c6a3466fb755acb8
- SSDEEP 196608:FY9/ini6U74pjhCtosK7EI/zaBpJrLoa59/fPeET22Nr+pA1Iflx9bi08At:F46UUBhMPkZ7UPHoa5lfPeEl+pAv08At
- TLSH
  T118C633484FFB691A299A89F431BA31129613B7C70C686376A4EDF40B7017BC4C85EF5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  actions/__init__.py
- Size 63B
- SHA256 909e6ff461d0fb1e971f4ccc7fd754d1555fffcadb30f67432f41863947df845
- MD5 3a91f7f1ef3357f4f1522137e8ebb935
- SHA1 2984d10bab5ae33441ef9863e8db0af7fc21070a
- SHA512 b505cfa37b44f41aa9157e3e82e278ea1961399c89ae287d1adb25ec14e4c78e52a2a6e95f9411909fa00de3c661bc4775c96064c2c9fb0e9874da280fa28863
- TLSH
  T1D0A00224B2D06A6157A289152653452428FEB07CE1905EE51812806E566D94649B2546
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  actions/about.py
- Size 63B
- SHA256 414e19388a97ce181d2cb6b359b4db2cf78bd3bd8b5b90fc63bfb3ce9f04ffa3
- MD5 7884c7becb618eb9165a411af3738072
- SHA1 41460183e4b123a0ec426ef77da3ee711d59d338
- SHA512 a0bd059a5463679936c00680dd77ba855e177363daaa691b88b82ca5b2943514be8e9b2e3628bbb3099c13f3cb07a527e31e2ea56d6176d81337d3e74dc70769
- TLSH
  T10EA02230B3C0082002A208282222000028EE303CC0888EF20800802C002CC0208B0202
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  actions/install.py
- Size 1KB
- SHA256 c6121cfed6ba4ec535d79cd7e0be44354f3f0f241c39e3e6887a6f3552813c73
- MD5 7ba3ef94e3efb8f4efa94c6645a86ab2
- SHA1 8eb5b921ed20f32d3ca2a6bf50bb87c159cfdf17
- SHA512 10f35fcd0de4551abccf9ab83bd028bb3cf5648dd639633534693f0b81e4ad0d49d2e4dc853cde79fd72593e45a61af99798fc2d25125bfe6933e73992bad7fc
- TLSH
  T18A4121145D1335A0B036C598D4274423E39B69130EB825B3F9FCC1289FB5963D9F6DA6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  actions/ui.py
- Size 7KB
- SHA256 53f4df2ad4592cc5ef52c2a94262a755c14c6cb8d6ff7fe8e20413e60fd71ba8
- MD5 8401d1ee895c4426dae18e313da20e76
- SHA1 27ceb3b178d5f3a86538587bac02e9117339de99
- SHA512 7c1cb2489ddd69a666c746b877f13186263b4edc11e09d3334478f088f7ea2a71891dc6d66c690accea4d5b143009ef68040b418be266b98c2d8b3ca6d63d8c1
- SSDEEP 192:XSpF9/QYIPQD07Q8irZ4QgIlFwQykQj9EQZIVuyA6i0I:1QCQ14QgIlFwQykQj9EQZIVupL0I
- TLSH
  T157F1AA3299617720927E8C18C477EC3AE7121AC38B756526F2FCC6A92F75872C8598DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  bot_actions.py
- Size 10KB
- SHA256 ac5cbced981c3866c3b63edb9ff5fc114377d9e828d689127cf4471aa3e62f10
- MD5 ca7b7045e8c8b49eb25bee467e993bce
- SHA1 1aaf764bdb0fd66fdb12f5878de4d7e8af018121
- SHA512 ab3ff3c2225833f09570838995447ad92e7609c75b64425b70f5a2a236e9c8454153f53108798fc8d5da1237f401d9f7fd03771e2611f61674d233e736d70443
- SSDEEP 192:YOPr2s5GpMTPGo3+SDIGSclpVWn6315RKVzRC36QQamCdxNdRxWQlrr54Kr1oUrK:rTGph7lGS1ns2zQNmCdHx1lps
- TLSH
  T158327821DC9A1C52C2BA881CD897C116F71A679305797922BABC835C4F748A4DEE6CF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  config.py
- Size 3KB
- SHA256 f7c5e87d6b861600e92d440a9546f344625d87a4bacebdc08c52c2d9eaa7129d
- MD5 2968bb2a85fccba7fe9fbe3ec7983e60
- SHA1 5a50e000ba136f6009f4c310a17a1ae662f3a324
- SHA512 ebfef4d48d442f843bc5d6dd7f6c6f7ea0f67c2d74a7c24b17ae92257bec4072961b1b66a6cc1c7a5feb5574638ef78e5d54194091d8231b9f35aae5c6bc906b
- TLSH
  T1FD81BD07DC8E6D6343F9893AE026E617F80DAFC702006825B9BCB26C2F7945389E751D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  main.py
- Size 3KB
- SHA256 a931fe4892bd013645cfd877ebd7f2263d426e3d5e03f4233e0d21c2dc1b35f8
- MD5 21983d0d1605b4e5f9bb2c1f1d3cc179
- SHA1 26b8858e1e34b3701deea5abd9bf082c449f5dd7
- SHA512 5028c5552afb3bd877e779e2663cb63f37daeb444acac51cb0fdc255b2b5ae044eab29dfdab13adc5392559de8eecf225ea5e427840bf57681d14fbe6ebb7eb3
- TLSH
  T1A08120276E0E29224677446DC697C890CE6753039B31687B70FD861C0FB58E0C9B7E76
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  run.bat
- Size 373B
- SHA256 81992f29c2c5ba5a792961eda49d6cb7175a588305c811fa1e047f7414a845d6
- MD5 4c9bb5a86fe1531798960cde0c7fd904
- SHA1 3f2cde175bf4d839c06c8251333023776e7fb6cf
- SHA512 6e20c94626c4a50eae37213af244ac6381e35b3551f3102d483cd58068052fa1877e05b67906e96890d092c5e19efea4b0b897930025eed3b5b37d44a74f3dbd
- TLSH
  T1F8E0D89A15042625C1B207DC08F42598FA0ED1B34AE8A9CCB75485A96F7F283A566ED8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

credential_access execution spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  scanner/cipher.py
- Size 2KB
- SHA256 5c45eac21d78492a7e3edd678e530a7057e5bc55b2b06ce76eb18642ab5d6926
- MD5 8c2e8bb0913278d59b96904c902333f3
- SHA1 71d8d9e7d4e24b3a00decdb9bf23519a7a7709f7
- SHA512 b7b31c70767fe4868a847306e29369c6629f6a0673d7c6d4a40d55dbe0ebdddc3993d1c7802c1bbba9fe0f6e86720b40429ff3c0839de3fab94278751e989c2f
- TLSH
  T19941F2A6BC27C4C543F1E12ED966C421F419F7178121A129761C9BA42FBB83CE1B109D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  scanner/client.py
- Size 2KB
- SHA256 4f5fe884349f2032e47ec90b3a18741bd80edf90789169eb5aaeab75e10c5427
- MD5 d531a7b51d5b6bfa64be0ff639868ecd
- SHA1 bf0821990fb0dea07cc7dc21f53af9e586022939
- SHA512 3fab1674f0714141b98224c2e9aaa27a6db2ea18f02b3896514717d96d6c0b4d2adccf2452314877d145e30d0231eba8e0588a2a802dade5cb4a845c4dd63ad2
- TLSH
  T12D51CEB06947B000C6F655AD557AA213F36FE6C76229012338BC94605FBB032DDF8D8D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  builder.exe
- Size 11.3MB
- SHA256 b3d7eeb00379d8672182923a162612bbef85243b8dd60a8a81a8a8edb4245785
- MD5 4d880030fafaaa53603a6e784aa6ed42
- SHA1 b564a078751fe81595a3881c3ea6bce9eaa72622
- SHA512 07088c9a1c14dd4dcadc5bc251b5acb85b5abcff883395670836b5956d77456b2df30121d88e6a001c94e4c0c8b0cfef2ab37fd93d562e214fcb455d52f4e1d4
- SSDEEP 196608:0ZkLDU1OkQDe/jhCZG+S72EtfYLdb71EOlb/h3mgTauJZWhWBcR11df+emi:CukQirhgvc71YVZEOlLh3mgLWhW1emi
- TLSH
  T176C633484FBB6919E99688F432BA71169203B7C70C696336B4EDF40B6017BC4C85EF97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution upx credential_access spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  scanner/env.py
- Size 1KB
- SHA256 f3da7c746fda2548c001e5100c6bf8e74bc502bcf518d5c1cfc6476e517ca159
- MD5 b16b819e209aa17f50da68df8d36bdf9
- SHA1 835a179e8f918c45fe751c05c7143ba269ab99f9
- SHA512 71a0b82c7a70ba699357f126ab413482ee6706369d4bf7b983d3831d4a33290967897c7a543d42e3bb7d3293f50eb07421ae7c50a0d445bca3bbe66a88c812f3
- TLSH
  T1423158A7EE5BDD1A637C1B0DC58AF24CE65642173D52860B7AFC6A7C2F344A040E1239
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  scanner/worker.py
- Size 5KB
- SHA256 8587e10715679b8f1812c7e94e2b60f8c495f23646df9a9ddd0c056b2ec03c8a
- MD5 19236ecfbb2276fe7acc0e7241495b92
- SHA1 26dd4fe1ab05b4e07acd10c175dfe154ae02e9b7
- SHA512 3b7f85838509e48438be6cb2841dfa42494838c1761348bc32ecb7eb7333851ba093720d8f985cfe7fc08c5976cd307a76391279067278f29fa5aed32e368046
- SSDEEP 96:fytY34t5cedrcr1rZgNYrZT9/H4k+iWTa/lj1RrqrXnztNYr0bo1c2k2gkF:rkrcr1rZgNYrZJ/H4k+K/l7rqztNYrSk
- TLSH
  T1CBB1FE95CD27B100C7BA886EA411A743E32B9387161E1572B6FCC3680FB4425DAECDDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28