41c3152bee4ddcc04b2c7af75aa3a0b628be94c76db9b9fb98d1be069c816066

General

Target
MateFall-nstaller Setup 1.0.0.7z
Size 147.6MB
Sample260922-pydd6sef48
SHA256 41c3152bee4ddcc04b2c7af75aa3a0b628be94c76db9b9fb98d1be069c816066
MD5 eb96312a5d719e7426f0dadfe7f8cd82
SHA1 5e085e592c9f57aaf0d07d25c03ad227fb5fe168
SHA512 08f391d934af1bca3a8fb8f3c063e918b2da7c52afd96bdbde873217a4bd237f0b71705772e44385fa2f6d958f0b0fcced3db1230873cb1d694b41b286682431
SSDEEP 3145728:bULfuiOwck5tYad4hThyDMDOMZO5JhlcYIIrjbVdTroUnnv3sQ:2p5MADMDOEO5QI/ffsQ
TLSH
T1B57833756385CAEAC33A947083536BA1F4BD76C2DE001B966AC370F4A7817EF4D18972
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  MateFall-nstaller Setup 1.0.0.exe
- Size 147.7MB
- SHA256 0f6877a18422f6fb7223f095b775f7a43a2b8e27659e74877e9ef60ca43457d3
- MD5 f2eaff9c904969bdc95b1840d6425116
- SHA1 d4e3b5af55899b891217bbff84134d54e77c3c5b
- SHA512 6eb485241302a6b0a2abc450aa4da8dff86656d06c2949d30134e0b354c65da012c626b33664216bcf76fd572dddab4925523f61a669632966ab9a0b6aa2597e
- SSDEEP 3145728:2LPlo/axrvfN27dSeQAtP3lIRADehjUrH05B7s1L0Gc/E/Lc5:nsfsjP3lIaDeH5S5w5
- TLSH
  T1027833756385CAEBC33A983083536BA1F8BD67C2DE001B9766C270F4A6517EF4D18972
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  MateFall-nstaller.exe
- Size 171.8MB
- SHA256 6586132aeebbacac37b53a80372b249cebd2c9507fae00accf2643986ceee422
- MD5 1d7afdfe044bf24b82b1543c960d8386
- SHA1 ef9699308e099cda8b7885f35776abb1bed46927
- SHA512 b38d3276c5b9eac8491713407180eaf721de7271ca64b21916b1fb1ddbfad29a77b675d707ac5c60fb003136827d56272ffce38d98aba9fb948a6764e2fd6e89
- SSDEEP 1572864:TasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:b4fc/M+i6xCL
- TLSH
  T12B888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence privilege_escalation spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral2