b09f79c27061e502552d9a1932939c0d790ca2cd628461e762747cb0b65f8395

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 142.7MB
Sample260811-vem26ahn71
SHA256 b09f79c27061e502552d9a1932939c0d790ca2cd628461e762747cb0b65f8395
MD5 006c7a6db66321589c76d5d06ca91b3c
SHA1 ed9bfb00c1835da376d7b8eaddc35d0544d2147a
SHA512 2b7c6c3fa68546863eab1bf950a73711b38920ea7289076ef9a3e5d9a46d9b52ef1fe5aa2131db3cb65e000d5192210a86dbdf280953899641f15964432c6e24
SSDEEP 3145728:bDv8P9vDSn/gArIyVRntoC7+yvXoKb2N1QYHKSQcTeOd60sh89QnG:k9v+n/vVF2JqSjd6n/G
TLSH
T1976833E106417A15C13EA138748CD2131BBD1E5AAE169EAF5E4CE425023BDFACF4F64E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Loader.exe
- Size 142.7MB
- SHA256 b09f79c27061e502552d9a1932939c0d790ca2cd628461e762747cb0b65f8395
- MD5 006c7a6db66321589c76d5d06ca91b3c
- SHA1 ed9bfb00c1835da376d7b8eaddc35d0544d2147a
- SHA512 2b7c6c3fa68546863eab1bf950a73711b38920ea7289076ef9a3e5d9a46d9b52ef1fe5aa2131db3cb65e000d5192210a86dbdf280953899641f15964432c6e24
- SSDEEP 3145728:bDv8P9vDSn/gArIyVRntoC7+yvXoKb2N1QYHKSQcTeOd60sh89QnG:k9v+n/vVF2JqSjd6n/G
- TLSH
  T1976833E106417A15C13EA138748CD2131BBD1E5AAE169EAF5E4CE425023BDFACF4F64E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution defense_evasion spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 6.5MB
- SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
- MD5 796505037e030807d9ddd01c93eb353b
- SHA1 79a1eac3b505e6d94a6206d4a5198d3cc11ab038
- SHA512 9435273a4541a579a427a295be47af8b81133896f50c97bab1d8ab391089f90186a7fd057b53e8b74829e4747e98428d8b4d242eb6854b1304a94a2891c2fd11
- SSDEEP 24576:8Pjy5WjWSpgDrAV8gmfwN6i6w6C6g6T+gH3BMbp0W:oJDN
- TLSH
  T19866942F7B48037306C602A2AB8BA5CBF21B903F3B565654345CD1681F6BE2543FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Loader.exe
- Size 150.3MB
- SHA256 fd19eff82da74b06ea4f25e76e5ab527480cf0e80881c22af3745543589b0fd8
- MD5 b31939f31a7720bc613ae5ab0ad75e73
- SHA1 5ef678bf2ebde9d0e8be81d6298a4c52ae8d9d89
- SHA512 be78146b2d48f8e5ad318fdb86cdacdafa28b99422c8c1e201de8da425a3801da10ca0ffaf2d1f4d6622d689c078a6ef2f1347a8e4642f9718a844a1034987e7
- SSDEEP 1572864:JlAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4Ze2OC2+:atSD64Jnqrt5v2
- TLSH
  T1E5788C03E2AA10D9E05DD1B5875B8637EE72BC460724B2DF265427562F77FE02B39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral13 behavioral14
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- MD5 cb9807f6cf55ad799e920b7e0f97df99
- SHA1 bb76012ded5acd103adad49436612d073d159b29
- SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
- TLSH
  T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
- MD5 00ffabbb9438a0da15a021451a9c2d0d
- SHA1 4bb79fe2b09962c6c46b70d7dfb1f9d9604a22dc
- SHA512 989d8d0afd3ce64c65a90d1046f28b19e5b125f8b5a565b76b8c950d152d3b9a57d68126888321c7cd8a4985249c1ec649c453e7501aaa4ff60d9662afd85f34
- SSDEEP 49152:cqMAAYNDEmcTfAZMHkwfPYX6Edxhi1uGaVrFY7Q9b5hpN3lzl3hHLNoJX:cGDfRMHR8rFYU5hNA
- TLSH
  T1C2D5AE07F6D600E9D01DC574879F9233F631384A4B24A5EB1A91AA242F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  libEGL.dll
- Size 473KB
- SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
- MD5 ef4291ace01485ee773183ee3c1ed5c4
- SHA1 9c9d32813a733ebceb25c0dbb9f85ef27f6e0a0f
- SHA512 a98bfe1845a712943687f0b20d1904bae1b6836ea37f8a2053872f938dceb2f391fadd3db034c0b8563c0b1ab3d4506d13b613ed51780ef10e813c085c830f82
- SSDEEP 6144:VTv0fq4dz9B4x4w/jvtGW9ZST3BypG48yOnb4pgsHVlAYnReZRO8:VTN4dNw/jvtGW9c3BypaagYnKRO
- TLSH
  T10FA47C11779954A8D03AC434CA134612EA76B8960F35FADF02A4D27D2F77BF85B3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libGLESv2.dll
- Size 7.2MB
- SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
- MD5 60e42e83b260582fc96aaf43293d99e1
- SHA1 c548a10873f9a57e18c7fbb1fe89685f4cf1ba84
- SHA512 6a905e2b9427fb6e4a53080afdc2ae9dc32c54aab5460f88f7d3fd16e7e9a841d332057f58942d54defe91361a54d3cbedba295399cead754f353f80f92f238b
- SSDEEP 49152:Rs95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJe5:2lq3ZieHhogDbBztUecv7r7frgsOMG
- TLSH
  T179766B07E6A581E9C05ED2B88B5B9222FD30BC4A4734B2DF266437112F77BE06B79750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar
- Size 120KB
- SHA256 560d51b6997ab2e02d84acdd914142b72406e78ee530a7a964d6d1a96b6205db
- MD5 a5a6afb18f29cbd6f19e6645380335be
- SHA1 b6179cb4f3277817e0e02b749013161d6eed8deb
- SHA512 12826e209804cb7e85d859467869e3c7ac7945d0ae5368584afcdf7a3526c016561f65f23d9a7d03148745d9d20f565a985b4c7cac88b69583ae99e630fb3fad
- SSDEEP 3072:zJYjqdXAaPNxKSbSlU3XwXOZtP4WGhPFzGakaPo8H:zJYjqMSr3+zGakaPf
- TLSH
  T11CC33A48AAFA235217B372B45A9F640B7279C013141DC955B9DCC3982F9843DE2FBED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  Python313/Lib/site-packages/Crypto/Hash/TurboSHAKE256.py
- Size 779B
- SHA256 ad79e152a2c83ee90ac61ff7245df570673fbe28720d9de8e07e2fddbf0e51db
- MD5 630fcfb160afd4a4b095c35901777556
- SHA1 0f039c3a2c5205d2105a79b5eb2777884dc8e490
- SHA512 9ed88da711066739edb47efb65755a57f9c18402a9ad5c112cf32be13b97615c2c835a46c8e4e5cd89cbdb5ee6a9be181a4cc42a1d6f4617f8aacb3c43f76878
- TLSH
  T17A019E152E0A421461FB51CF7A797419E332B6076104B1B378ACCDD21F34423CFBA50D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Python313/Lib/site-packages/Crypto/Hash/_BLAKE2b.pyd
- Size 14KB
- SHA256 4fbe188c20fb578d4b66349d50aa6ffe4ab86844fb6427c57738f36780d1e2e2
- MD5 309d6f6b0dd022ebd9214f445cac7bb9
- SHA1 abd22690b7ad77782cfc0d2393d0c038e16070b0
- SHA512 d1951fe92f83e7774e8e877815bed6e6216d56ef18b7f1c369d678cb6e1814243659e9fa7abc0d22fb5b34a9d50a51d5a89ba00ae1fdd32157fd0ff9902fb4b7
- SSDEEP 192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
- TLSH
  T131523B0BE36544ECFA2B82B881730A1AF6A6B560631177DB037092962D277D1737E7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  Python313/Lib/site-packages/Crypto/Hash/_MD2.pyd
- Size 14KB
- SHA256 d54375dc0652358a6e4e744f1a0eaeead87accd391a20d6ff324fe14e988a122
- MD5 52dcd4151a9177cf685be4df48ea9606
- SHA1 f444a4a5cbae9422b408420115f0d3ff973c9705
- SHA512 64c54b89f2637759309ecc6655831c3a6755924ed70cbc51614061542eb9ba9a8aecf6951eb3ab92447247dc4d7d846c88f4957dbbe4484a9ab934343ee27178
- SSDEEP 384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
- TLSH
  T1FF52A845A9688BBCEDB541F0B0722B5E71E97F119311EEE723A042971D266C0327EFE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  Python313/Lib/site-packages/Crypto/Hash/_SHA512.pyd
- Size 26KB
- SHA256 1729a0dc6b80cb7a3c07372b98b10d3c6c613ea645240878e1fde6a992fa06f1
- MD5 0931abbf3aed459b1a2138b551b1d3bb
- SHA1 9ec0296ddaf574a89766a2ec035fc30073863ab0
- SHA512 9f970bb4d10b94f525dddde307c7da5e672bbfb3a3866a34b89b56ada99476724fd690a4396857182749294f67f36db471a048789fb715d2a7daf46917fc1947
- SSDEEP 768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
- TLSH
  T18DC2D802EC685724CC16973947B8DF3AE6A4B71483E0EAF706E231C82D565C72BB85C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32