Overview

overview

10

Static

static

jkpdfjmkbtp007.exe

windows7_x64

10

jkpdfjmkbtp007.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jkpdfjmkbtp007.exe

  • Size

    92.0MB

  • Sample

    210926-3ah7eafchr

  • MD5

    aa420131ec9d014cbee50b5c2165862e

  • SHA1

    b659fd3e31e93c6238cfaebf6ddbe40af4ab73d9

  • SHA256

    dfee64d57c80cbe466ff2dac34fdacb2fc12e9956ab607169d310aa78edc66c2

  • SHA512

    4a265d4f3d2acef52fea1d3910bdbb74f86e6f7863d116bd8d8787c5aabb7bb151da12c6e638e8da66f756434446709f11db1810e1420e955ab0f5f98a9e6e00

Score
10/10
discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      jkpdfjmkbtp007.exe

    • Size

      92.0MB

    • MD5

      aa420131ec9d014cbee50b5c2165862e

    • SHA1

      b659fd3e31e93c6238cfaebf6ddbe40af4ab73d9

    • SHA256

      dfee64d57c80cbe466ff2dac34fdacb2fc12e9956ab607169d310aa78edc66c2

    • SHA512

      4a265d4f3d2acef52fea1d3910bdbb74f86e6f7863d116bd8d8787c5aabb7bb151da12c6e638e8da66f756434446709f11db1810e1420e955ab0f5f98a9e6e00

    Score
    10/10
    discoverypersistencespywarestealer

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks