Overview

overview

8

Static

static

8

SecuriteIn...21.exe

windows7_x64

8

SecuriteIn...21.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.Heri.12406.5921

  • Size

    374KB

  • Sample

    200711-ty1ea1spae

  • MD5

    4893bfd786e238be745d4ac8a2e5fa45

  • SHA1

    34531f4fb7876475e8820a72672c47fdca1ad20c

  • SHA256

    b841402ba599fba5dc3b4775aa53e26445a49c4d7df1fa8e64d26c4cc16c5083

  • SHA512

    39f5ca24743f1272f26fd58406e8a7f54f82bf3c09581ca205b8130479687e90023298d99c57f4e67e23fc096a0830f1706fa7f84d8766529deb67c9e689517d

Score
8/10
persistencespyware

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.Heri.12406.5921

    • Size

      374KB

    • MD5

      4893bfd786e238be745d4ac8a2e5fa45

    • SHA1

      34531f4fb7876475e8820a72672c47fdca1ad20c

    • SHA256

      b841402ba599fba5dc3b4775aa53e26445a49c4d7df1fa8e64d26c4cc16c5083

    • SHA512

      39f5ca24743f1272f26fd58406e8a7f54f82bf3c09581ca205b8130479687e90023298d99c57f4e67e23fc096a0830f1706fa7f84d8766529deb67c9e689517d

    Score
    8/10
    spywarepersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks