Extracted

• • Target
    -VladMelSM-main.zip
  • Size 3.4MB
  • SHA256 f40d051fb022225bed03d41f580b661fcead69303bc53bb76d44b4b1c55635d7
  • MD5 2d9c1ee6df6478bc937ffd209648a0df
  • SHA1 2f0bdda12d79d1ad753fdc0be6e5e5bd930ae940
  • SHA512 5a8cc0e8232830bb1c689a918f8779f029012a76ce7900a1806273029f62a04ff4508f41c367c031099494d3b4c02ed16d8bd9cbdefe771bbadbcf69938e8ba2
  • SSDEEP 98304:l0elXbW+5704+0BkrqZNmBDYLHFW/9wahPNRum:blX62045mBDYRyH13
  • TLSH
    T159F533C298B8D8C0E15CD1A8E0333617372DDD865668A71EC3DEEF184163969A5FD23E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    -VladMelSM-main/.gitignore
  • Size 290B
  • SHA256 affbdc2a83b7d656b98cb2f77f6c33e8ce8221919ea1a50d803b19647588f07d
  • MD5 a21937e4390e853a6476678364b3bf90
  • SHA1 d43d4e49facfbc2b3401c825fd257abac498be81
  • SHA512 f34afdf1ab31fa26bd04c104baefab0a2e77403b960db5624f29b6a3de5496b518336761e10f17b8c467d9c8ecf4f4d6ca1d23940e3017c404c9d9afe38223e4
  • TLSH
    T1B8D02B8D449F984D5E7158C733FA7102E45DEF8E6B05D575F16845E5A70002930C3029
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4
• • Target
    -VladMelSM-main/CNAME
  • Size 19B
  • SHA256 e64e1bc24155dc55de4a16ec12a4bcfa0688b7629c305d468a347f1ea2046767
  • MD5 581a41727e634da5d52004242aa29f89
  • SHA1 629c5d59d996a0483a5e5c83146a2d5188ee0ad5
  • SHA512 8bf9a243693d296ec26966559751ad1492b93a1e1ee3fe8d4cc040cb3a02302b1115d94fe7e3bcbf3150425ecb41ca5a013dc821099a3feaf85c0185148e6d32
  • MD5 SHA1 SHA512

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    -VladMelSM-main/UserAssistView.exe
  • Size 3.4MB
  • SHA256 0feababcec8c64a26548c566d4e4b190b172058f62c2069b2e5d86c8736a9a20
  • MD5 527e5dfa3b9add708ac4d6f0c76fdf0b
  • SHA1 7bf63cf4f006c363d290270832122ec3d4ce61d8
  • SHA512 8f5eac91ffdb74e7f0f6baf44dc8ba30413122e3637cf5d2769aa7d388b8a3d8659453538b060f231c11f4616304f6fc4e2ba3112d69b3e1aa1321d500c83c7a
  • SSDEEP 98304:xwxTzIQ57ISgYtGj+fn2ND8HHhyhD2aZx5/s:CxTcEIS92ND8hSrl
  • TLSH
    T110F533C694B9D4D0E15DE0B8E0333617332DDD824564A72EC7EEDF1801639A9A6FD22E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverysalatstealerspywarestealerupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral7behavioral8
• • Target
    -VladMelSM-main/index.html
  • Size 604B
  • SHA256 2148544ac85d355fe84f5be95010a68370e6f47dbf3692d6e48c192a7cc90c95
  • MD5 1007292ac7125618f1fcd69456e7a436
  • SHA1 5cc8fd577fc85024b0a94ba5765612aa05be02b4
  • SHA512 24bfc8adf59867b999fd9768804a32e901d2f0a25a14df4c4a93f4ad988c7f87dfe11c0e2f4067766ab8455c4d33a0d23cc4a5d1b5780b2839c9e7b689cb4289
  • TLSH
    T198F04760470C8B5F4AC532E3309A272305A7395FB020FC64F6F5CD1AF145630123B185
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionsalatstealerspywarestealerupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral10behavioral9