Monday, July 6, 2020

Analysis of Spotify Harvester (Malicious sample)

During our malicious sample collection, we spotted a new sample as spotify_harvester.exe. Let us share the sample details:

File Hash:
MD5 d7f0b4c662d3e9615d3e5b4e064c6d28
SHA-1 bab580c13c78e95ecffdb7c1f7e10895b4b41b88
SHA-256 28b3b2bea88b61c48ed314c72947e76379b8e56e6780a18f8db2b2d939e1230e


File version details say as Spotify harvester:

File Version Information
Copyright
Copyright © 2019
Product
Spotify Harvester by HarveyS007
Description
Spotify Harvester
Original Name
Spotify Harvester.exe
Internal Name
Spotify Harvester.exe
File Version
1.0.0.0
Comments
Spotify Harvester by HarveyS007

Visualization of connections
Process

Processes Tree

 496 - lsass.exe
 2428 - setup-stub.exe

MITRE ATT&CK™ Techniques Detection

We collected the related samples found in the connection:
SHA256 SHA1 MD5
28b3b2bea88b61c48ed314c72947e76379b8e56e6780a18f8db2b2d939e1230e bab580c13c78e95ecffdb7c1f7e10895b4b41b88 d7f0b4c662d3e9615d3e5b4e064c6d28
ffadaf995966f1eedaab15c3559926209058ec1dfff5292db9b0b6782afbf78d ef31085cdb532072078ec1886cca2d6f3ef9e98b cdb463d1112c4f7818ad6191394c4ab7
cf46aa24f1a6ee25fd98dcf3b726008fb0424fb20bed93d83b73ca58c800056b 991df15b121075e7c049e5e3cde1ff0b4d336efa b79ee19e1fae57a9f8c4b05a706ac306
7d8863126aa4f129c99cf3885a81213b6428a87d6ab3143ae09d85cba0b4dcc1 8fc000d008daaec26a379c5e66a16f528907d1c2 940a4ddcaf0cc7413f61692ad06097d1
20c5546c8776f8e15df8b56bb13c7a0c29c393940295ca95b7ed183d92fb1602 54179ff9dc4fd61da1b55d870f0f0d2fc4223d90 fa60c567f34d33ff6abfad2508014eee
7dad3418869091ebaad9a9a6c95f44bea76cbaf457c0934f300e8a8e9e146959 0be1c4fe69befa761ccc5eecd5ce05254c478a2b 3744d094eec683956b80151a0690632c
a061fb9134b2dee0e5a85d41331ee72cf2ab491a0a86e89517f28dfc2f3cf2db df437e376a62b527655089682c86a3c5e8c5cd8c 3e73adcfbc74dd63e542a0a2c7d7b3e4
0a52d002e382bb2364f2519921859ca1ff6a53a6e40fcfe40f690c33a266af10 403f78975df1beb4b48da0901663e3e1587c73c7 3fb5b2fee989c1161f66af5216594ef9
f4d913313595dc2631553b5a720ed98e11d66579deaa40829100e7905570d900 4b0cbe419c66fb2c9a00b60ae13cc433523653a0 c6d06c62dbc2d56604678dfcb81aae05
f0913b66b67c524bd898738834f3a41c7871d78085aae188ce1e24089f1d757f 8d99fe3f31533d772e71576701427e9d00283227 d03d0275e78f6a167af4603f6a86143c
18f194ee61ed1ae3db5bd823d28760b8cb37c59b6cc80d4568c3b5422db26733 9dbfd33a828a7c444e739b976c4ebe2082af0d56 fde18edb37d3faf1be3e6260add8bb72
a9fa7ad343111ae9bef2ca8b731ce9625f205d24ce78495a2ade2d7062dd4664 d79776fb97058d951b84cfc89ec605932c8954c6 ab81780a47192d0b015bef8405387a80
bf9b5bb2a48f07a7bb405db85d25ae86798e1918a12aa2aa09bcdc185113474f c8e58d8ecc29046a51f81e22def6bda009166436 325efa56bf1faa6d8e2f0524534d1f13
f5fd51410f083ac0a5721c576d50c4b39233ad25bc0957cb9461335424825628 2a6fe0b37a2b0a169280b44cc303056c83584b62 67f47b328661d9e027e6859754e8ba2d
a2a9b62a71aea54116a7c8b4ad8919d893a7cb52fe875982fcb82ac3bcdfcbb6 8c9bd5ee832338a06da069994c4fc373b6531bc1 7efa8cf96a33b697a729055446421aaa
5ba0f7e84a23d6e0aac0983d0d45d4c50a0b1702366718eec3ba4341b9a0b3d6 3b9821770fca7cc8d5a9b244a76bbb2e680b34f5 d0cb97e6e0c91796fddf85a9035a1474
6a73a588b9dfc5adb223602f09baec7dff2c2297ca8a921dbb72543c073aac3a cf1ac7bfa9df224b493ab77feb649e686cd73ab9 f48f31054288e16800a16cc3c1b75762
c2d16531a61307a41d656cb7945dadfcd0b0e260c5841e95fd82c9012e825562 224c88ecf3a6e807595eb36ef4a35d87e94a04c9 eb1c17165cb31f5607ff69faa480f7a0
78bfbb1e28d897f64c7137d25a4e8037c1d6b4582d27c757fad2d8422004eaff 3a93938485ec011254ba033d83e03865dae28cb1 aba3d6fd53491ee4a09682d15171aaf1
ee3a632ff9bf3324ae854daeb820f65d5af939ea29b55f2e61bfb1d01b270a65 fa7f58bf05fadac32e77db031c354fa7608d9709 23465fcdec49d71afb6af505dcfbc09f
bf3aff05d0412ac95b8fa2e18e2264908176b9c4da72b5ca78dcc58ab6abe592 42fcdd584f1b06ecdc513b03f8fd28ef3a6beb79 f96c68678ccd3155dd1191efda27ea9f
adc02fcbd19472c127a28476a68c3fc9b03108c4b067e09fccb2d8204295edd6 a9b744521d54d701d125d0379f72c0e6c1780c66 49d80e396fca47e6b45c790e51d72156

Post made by

No comments:

Operating system - Part 1:

 In our blog, we published several articles on OS concepts which mostly on the perspective for malware analysis/security research. In few in...