Overview

overview

8

Static

static

8

852120f27f...93.exe

windows7_x64

8

852120f27f...93.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593

  • Size

    2.4MB

  • Sample

    210302-xgjd1734gn

  • MD5

    a5e59a6ecd6a238985670d0c161e4754

  • SHA1

    3e9cb91346365ad2bcb3c6bfbdf6cb1975dc1fdd

  • SHA256

    852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593

  • SHA512

    afab9408422f748514bdaa2a0aa3ae8a74946e405080eb10b499c02f27d4664c47e5d8cae1615d9e586fb188f0a6115acbc3c31990a64ce8f672b2eace3ba7a5

Score
8/10
spywarevmprotect

Malware Config

Targets

    • Target

      852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593

    • Size

      2.4MB

    • MD5

      a5e59a6ecd6a238985670d0c161e4754

    • SHA1

      3e9cb91346365ad2bcb3c6bfbdf6cb1975dc1fdd

    • SHA256

      852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593

    • SHA512

      afab9408422f748514bdaa2a0aa3ae8a74946e405080eb10b499c02f27d4664c47e5d8cae1615d9e586fb188f0a6115acbc3c31990a64ce8f672b2eace3ba7a5

    Score
    8/10
    spywarevmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks