f55a8b1533efa42e56d86ca751e1005819248ce84f131af46594db17ccdfdfc8

General

Target
volt.exe
Size 10.8MB
Sample260908-mtk74sycma
SHA256 f55a8b1533efa42e56d86ca751e1005819248ce84f131af46594db17ccdfdfc8
MD5 c5c771a55a298169db38a59778ec1318
SHA1 6e78cf4e5cbd9a3ac60a9d5667bb43436fc6782f
SHA512 8cef434134ce31b5060c3a041a582bdfc5b5927312741bc20e2e514e17b24c2fbe06ace5e3d5241149440b1e0552d958e4d483edb486e9f8bd41671eb05c49aa
SSDEEP 196608:IAKb990xIxQXQ8FRvXpT2MFr3GR9kWL67ZO+qwCRbSQQWRNC6P9hanHOsrAtrvQe:ITbX0xIiXQmpT2qr2/6ZOrlbXRNCCOun
TLSH
T174B633B878D0E2F7D6F4043B15FDA6C235D723064AE6530023E426793DA287A5A3D96F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  volt.exe
- Size 10.8MB
- SHA256 f55a8b1533efa42e56d86ca751e1005819248ce84f131af46594db17ccdfdfc8
- MD5 c5c771a55a298169db38a59778ec1318
- SHA1 6e78cf4e5cbd9a3ac60a9d5667bb43436fc6782f
- SHA512 8cef434134ce31b5060c3a041a582bdfc5b5927312741bc20e2e514e17b24c2fbe06ace5e3d5241149440b1e0552d958e4d483edb486e9f8bd41671eb05c49aa
- SSDEEP 196608:IAKb990xIxQXQ8FRvXpT2MFr3GR9kWL67ZO+qwCRbSQQWRNC6P9hanHOsrAtrvQe:ITbX0xIiXQmpT2qr2/6ZOrlbXRNCCOun
- TLSH
  T174B633B878D0E2F7D6F4043B15FDA6C235D723064AE6530023E426793DA287A5A3D96F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation pyinstaller spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1
- Target
  Volt.exe
- Size 10.9MB
- SHA256 0c44f370a2cd3683ccbe403c6cc86a313c69a262b211b28554e19c02fcb789a3
- MD5 4c38734418e9fc3d8bd9f2a5a94234d0
- SHA1 afa93dfdcd9bc54517efeafb9feb1868a0436c35
- SHA512 cfbc946ce3617e35e77cf890b7f493b88f483be732ffdc091ac99486c18f16e00df1a26dbca34e077cc4278957e81648457bc9a507a78ac79ae40d00c9710347
- SSDEEP 196608:l+bsnYryXEpXnH2ph1iut32LxSiLCw10+u41ZPcUoeg/5979at5WvonYpPT1RrZ:MAnY+XEAphVta510Mjoe65K5WvUYD
- TLSH
  T104B633A877A051FBE8B6413D99D6C802E3E231121B92D3CB13B4157A3E675F05E3CBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral2