c7d0667415a777e1c2ec3812912ff0e33a103c7a873b2f1cf637547bf8027cfd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d7586ef8070b30908091c3ad10508249.exe
Size

849KB
Sample

200707-fpjx5yvyza
MD5

d7586ef8070b30908091c3ad10508249
SHA1

38120210736c1fb5bbb16804894877f5df77268f
SHA256

c7d0667415a777e1c2ec3812912ff0e33a103c7a873b2f1cf637547bf8027cfd
SHA512

93c55b02ad116d778e86749de478ffed42c0558e31784f1c96922b57232b6d4970191d4a84b99f0cbcf91a1fdf8929c3987dcd69bd6a8be4e5cf0356750385d8

Score

7^/10

evasion persistence spyware trojan

Malware Config

Targets

- Target
  
  d7586ef8070b30908091c3ad10508249.exe
- Size
  
  849KB
- MD5
  
  d7586ef8070b30908091c3ad10508249
- SHA1
  
  38120210736c1fb5bbb16804894877f5df77268f
- SHA256
  
  c7d0667415a777e1c2ec3812912ff0e33a103c7a873b2f1cf637547bf8027cfd
- SHA512
  
  93c55b02ad116d778e86749de478ffed42c0558e31784f1c96922b57232b6d4970191d4a84b99f0cbcf91a1fdf8929c3987dcd69bd6a8be4e5cf0356750385d8
Score

7^/10

persistence spyware evasion trojan
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run entry to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywareevasiontrojan

behavioral2

persistencespyware