Overview

overview

10

Static

static

3

AkebiLauncher.exe

windows7-x64

6

AkebiLauncher.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AkebiLauncher.exe

  • Size

    8.7MB

  • Sample

    230727-vzge4sgd88

  • MD5

    346403dc2892f3f445123f001a6709cb

  • SHA1

    b59e5a76feeb079cdea6a4a39544175d9f8a4d70

  • SHA256

    e45e34b67a7c2a3073721b7f274087d9099289881c5701129b339ecfa9a6bf0a

  • SHA512

    0c90f77b60ae4b30a7310172b1b438613a0f328e6935f1e74f14b406f62929f3270254b7026923a8d650e5d50eb7241d1901d524833379f67acc48129b1236df

  • SSDEEP

    196608:zBRNqLt94ZYvkM/IuuVkEwu01+pYxfdkKZhYLN/ajKLt/G38Ck:zBcKZYvjwqECAIrZK5/ajx

Score
10/10
shurkinfostealerpersistencespywarestealer

Malware Config

Targets

    • Target

      AkebiLauncher.exe

    • Size

      8.7MB

    • MD5

      346403dc2892f3f445123f001a6709cb

    • SHA1

      b59e5a76feeb079cdea6a4a39544175d9f8a4d70

    • SHA256

      e45e34b67a7c2a3073721b7f274087d9099289881c5701129b339ecfa9a6bf0a

    • SHA512

      0c90f77b60ae4b30a7310172b1b438613a0f328e6935f1e74f14b406f62929f3270254b7026923a8d650e5d50eb7241d1901d524833379f67acc48129b1236df

    • SSDEEP

      196608:zBRNqLt94ZYvkM/IuuVkEwu01+pYxfdkKZhYLN/ajKLt/G38Ck:zBcKZYvjwqECAIrZK5/ajx

    Score
    10/10
    persistenceshurkinfostealerspywarestealer

    • Shurk

      Shurk is an infostealer, written in C++ which appeared in 2021.

      infostealershurk

    • Shurk Stealer payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks