Overview

overview

8

Static

static

8

a6964b245e...dc.exe

windows7_x64

8

a6964b245e...dc.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

  • Size

    374KB

  • Sample

    200709-km83ecs7ce

  • MD5

    7a9f3d5d28718c039c591c3077b2be07

  • SHA1

    bd07de2bcb53f2ad0fa3918827da9f2779f6500d

  • SHA256

    a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc

  • SHA512

    107dbfba2150f35cb7eef5b030cb449ce1ea2ef073392cc7d02b671aacd4d066c1fd6c04d48740e024d523393f60755e893c722e43ff83249ef4991ae3370134

Score
8/10
persistencespyware

Malware Config

Targets

    • Target

      a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

    • Size

      374KB

    • MD5

      7a9f3d5d28718c039c591c3077b2be07

    • SHA1

      bd07de2bcb53f2ad0fa3918827da9f2779f6500d

    • SHA256

      a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc

    • SHA512

      107dbfba2150f35cb7eef5b030cb449ce1ea2ef073392cc7d02b671aacd4d066c1fd6c04d48740e024d523393f60755e893c722e43ff83249ef4991ae3370134

    Score
    8/10
    spywarepersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks