Overview

overview

8

Static

static

f063c19747...42.exe

windows7_x64

8

f063c19747...42.exe

windows10_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    f063c197471def0a2e37f80f83197e42.exe
  • Size 813KB
  • Sample200704-rcs3vhpma2
  • SHA256 d996151f4cb4abfd48fb856239ea0e2cc54ba89954586aa07a67135a0e15ad8a
  • MD5 SHA1 SHA512
Score
8/10
persistencespyware

Malware Config

Targets

    • Target
      f063c197471def0a2e37f80f83197e42.exe
    • Size 813KB
    • SHA256 d996151f4cb4abfd48fb856239ea0e2cc54ba89954586aa07a67135a0e15ad8a
    • MD5 SHA1 SHA512
    Score
    8/10
    persistencespyware

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks