General
- Target Simple checker 4.4.2.zip
- Size 84.4MB
- Sample260823-ejyrfsxvav
- SHA256 1bb8612804a8d12c5161b76d95e7816da611229f6a016c3da41e6fe21b6970a6
Malware Config
Targets
-
- Target Simple Checker.exe
- Size 24.9MB
- SHA256 afe46999748f64442631212d001564f04af2526060f914161d25992e619e3802
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target skyline.dll
- Size 16.5MB
- SHA256 ee164a9ea084d7a775df11b694ecdaffa3fb3ab0a4f1edf718c8c726d01d07dc
Score7/10-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target skylinesloader.exe
- Size 19.7MB
- SHA256 7ad69e000cd4f0854fd444a4973da7d14db8d86103394d267efb9f96323ca263
Score10/10-
Detects SvcStealer Payload
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target w64ms.exe
- Size 26.2MB
- SHA256 30baaf04f06726e3a6f59c2fe1ad02400aeb7725d6f5cb429a357a9d77cbd24f
Score7/10-
Loads dropped DLL
-
- Target w64ms.py
- Size 4.8MB
- SHA256 7cb302b223b3e8abbe31ca48bc66e14c906fc2e39ea5b41b1fa4e7d7872f1feb
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1