Overview

overview

7

Static

static

3

mudinho.exe

windows10-2004-x64

7

mudinho.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Mudinho Stealer.exe

windows10-2004-x64

7

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

resources/...elp.js

windows10-2004-x64

3

resources/...elp.js

windows11-ltsc_2024-x64

3

resources/...x.html

windows10-2004-x64

3

resources/...x.html

windows11-ltsc_2024-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...ase.js

windows10-2004-x64

3

resources/...ase.js

windows11-ltsc_2024-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...ate.js

windows10-2004-x64

3

resources/...ate.js

windows11-ltsc_2024-x64

3

resources/...kup.js

windows10-2004-x64

3

resources/...kup.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    mudinho.exe
  • Size 70.6MB
  • Sample261007-y589vset2w
  • SHA256 4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target
      mudinho.exe
    • Size 70.6MB
    • SHA256 4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      Mudinho Stealer.exe
    • Size 180.0MB
    • SHA256 de07984d4e7004ece62f95f26584a10fd152885b137fdc57397f388eb327c488
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral9
    • Target
      ffmpeg.dll
    • Size 2.8MB
    • SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      libEGL.dll
    • Size 481KB
    • SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      libGLESv2.dll
    • Size 8.0MB
    • SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      resources/app.asar
    • Size 63KB
    • SHA256 786bbcff55ab939a24409f9f8f94f85c1a0a8771d3f7eb59f0c6f52b1197a924
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      resources/content/help.js
    • Size 2KB
    • SHA256 4ba39ec3e5c9a84ae14065d50180629d71c9b91a6be8c8a45f918529a0fb4ca9
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      resources/content/index.html
    • Size 5KB
    • SHA256 06440c1797d1f7605d41c4a6a24c03d5375210a94b3e5a12b0dcb648d880b2dc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      resources/payload/node_modules/better-sqlite3/lib/binding/node-v115-win32-x64/better_sqlite3.node
    • Size 1.6MB
    • SHA256 1eeaea9a4acb37a35d5057ab76b9ca923b6684df019b1316717f1ea6d9eff1a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      resources/payload/node_modules/better-sqlite3/lib/binding/node-v130-win32-x64/better_sqlite3.node
    • Size 1.6MB
    • SHA256 d5abe263dae05c964857e181927f77783f48893e5900407b3fce6e0d3ea21bc6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      resources/payload/node_modules/better-sqlite3/lib/database.js
    • Size 4KB
    • SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      resources/payload/node_modules/better-sqlite3/lib/index.js
    • Size 110B
    • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      resources/payload/node_modules/better-sqlite3/lib/methods/aggregate.js
    • Size 1KB
    • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      resources/payload/node_modules/better-sqlite3/lib/methods/backup.js
    • Size 2KB
    • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

2
T1047

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Modify Registry

1
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Wi-Fi Discovery

1
T1016.002

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer
Score
7/10

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer
Score
7/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10