fc683727b2f227ff4c4f35cef8e6f6003a8dae3d47c058c07cabeb05dab40582

General

Target
OpalCraftSMP.7z
Size 110.0MB
Sample260821-prs62sbd99
SHA256 fc683727b2f227ff4c4f35cef8e6f6003a8dae3d47c058c07cabeb05dab40582
MD5 939c10a73c297d5e2945d522db44b9f5
SHA1 bc90e7c26ae28a2e2d299d2ef2ade07786cc6f83
SHA512 14fbbcd271bd7f161765d8df3c23066f0fde8170d0683c4aa4fabb5a28f71e195e52b06cafde59e9a7d24868ddf400901d2bad67a9235abf583e5571a187301f
SSDEEP 3145728:dIDW146xeYqWuQnGAKcjhEvMo2yh2CtL20my:h0auQnG/vZ2CtSy
TLSH
T1164833F35B9488FAE73BB4715299AF66652C1A43D30866FD678061F113703CE0DAC8B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  OpalCraftSMP.exe
- Size 110.1MB
- SHA256 555e7a5a05f59da6ea0246b98fc4c001f2ebb7ef79950700622b2ccb09e92063
- MD5 7278d993ef171ad971898e506310efe4
- SHA1 6e42bab3af0c24f02ae6406f5a275595072e836a
- SHA512 4a2a2fed7ab59cc7f7e593945a602a74dcc00fd1cfc1c225de234f63737e61013fa285e780a375a4e9ae1c464f9be39a401458c40a3e4ec22a32436e7afc2ef2
- SSDEEP 3145728:SePlh2MA1IKzN48ehjUrH05D7s1hssLaNwVQy:jizN48eH56ssLa7y
- TLSH
  T12F4833B29B9488FAE33BB4714255AF66792C0B43D30862FD678461F127703CE5D9C8B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  OpalCraftSMP.exe
- Size 171.9MB
- SHA256 c9ad3cf8553a77df6a333fe72f60ece2544fff24f6c60caf85cdbe32281a6045
- MD5 acf8f5b2fefb6f35f8ef382a01279710
- SHA1 158cf12a08c64c7e7d34c3d5685fd7d84facc42e
- SHA512 7aa27de37bcbe486bd2740e5832008e745be8e3354ccf4ac64e7e019227cea42e54a0cb04ed0b6c33c523dd259ce66fbc3d787f0aac629e9cfacf5bec00a74e1
- SSDEEP 1572864:LasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:D4fc/M+i6xCL
- TLSH
  T13C888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2