Overview

overview

10

Static

static

Archivo-Fa...01.exe

windows7_x64

8

Archivo-Fa...01.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Archivo-Factura-Telefonica0054487901.exe

  • Size

    7.2MB

  • Sample

    200709-gnhdkjd64x

  • MD5

    0942f77f57ddfef74dfacbcb9ad4cb5c

  • SHA1

    8e7f652e9e63d249a5b02f3caeec9a720b58b11d

  • SHA256

    c3019b15a61bc3f84e6f7eb3779a26a25556a934b1fa567d51708c16dfd1b632

  • SHA512

    97646d8586616d5f0894231bf1a824d5ee7b9e043fc539b5385a2591660a60f75c966cac803a1cada21ad78098c901340504e188a7ef258c00a18f00e4433684

Score
10/10
evasionspywaretrojan

Malware Config

Targets

    • Target

      Archivo-Factura-Telefonica0054487901.exe

    • Size

      7.2MB

    • MD5

      0942f77f57ddfef74dfacbcb9ad4cb5c

    • SHA1

      8e7f652e9e63d249a5b02f3caeec9a720b58b11d

    • SHA256

      c3019b15a61bc3f84e6f7eb3779a26a25556a934b1fa567d51708c16dfd1b632

    • SHA512

      97646d8586616d5f0894231bf1a824d5ee7b9e043fc539b5385a2591660a60f75c966cac803a1cada21ad78098c901340504e188a7ef258c00a18f00e4433684

    Score
    10/10
    spywareevasiontrojan

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Enumerates connected drives

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies system certificate store

      evasionspywaretrojan

    • Program crash

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks