Overview

overview

8

Static

static

d1b7c404ce...79.exe

windows7_x64

8

d1b7c404ce...79.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1b7c404ceefefe42c9ff2a4f055b81d11115f8e00d1b5f295b2b61e414bda79

  • Size

    4.4MB

  • Sample

    210509-y6fnas6j3s

  • MD5

    6a8e0d62931c15b864f73c17ed81eb2b

  • SHA1

    92628c2161157a31ae65db4fd8f2f0fe1045da1e

  • SHA256

    d1b7c404ceefefe42c9ff2a4f055b81d11115f8e00d1b5f295b2b61e414bda79

  • SHA512

    d997292e86e84fb93a1e80c274ffdad8848522e5af6c101bd1c19cfc9bc830100e725adc58b41dda4d2712b5a91f1f17b24f1bef8e11e194d196954b2da842f8

Score
8/10
macropersistencespywarestealerupx

Malware Config

Targets

    • Target

      d1b7c404ceefefe42c9ff2a4f055b81d11115f8e00d1b5f295b2b61e414bda79

    • Size

      4.4MB

    • MD5

      6a8e0d62931c15b864f73c17ed81eb2b

    • SHA1

      92628c2161157a31ae65db4fd8f2f0fe1045da1e

    • SHA256

      d1b7c404ceefefe42c9ff2a4f055b81d11115f8e00d1b5f295b2b61e414bda79

    • SHA512

      d997292e86e84fb93a1e80c274ffdad8848522e5af6c101bd1c19cfc9bc830100e725adc58b41dda4d2712b5a91f1f17b24f1bef8e11e194d196954b2da842f8

    Score
    8/10
    macropersistencespywarestealerupx

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks