Overview

overview

10

Static

static

Vdslzshvov...tj.exe

windows7_x64

10

Vdslzshvov...tj.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
  • Size 929KB
  • Sample211017-h2ps2sdcal
  • SHA256 67c445ff181fcaa6b46a1d1af78a9df1ac413593f29561e4fa43059c7ed85ace
  • MD5 SHA1 SHA512
Score
10/10
bitratxenarmorcollectionpasswordpersistencerecoveryspywarestealertrojanupx

Malware Config

Targets

    • Target
      Vdslzshvovgybkzgrzotcepodrxkmdpxtj.exe
    • Size 929KB
    • SHA256 67c445ff181fcaa6b46a1d1af78a9df1ac413593f29561e4fa43059c7ed85ace
    • MD5 SHA1 SHA512
    Score
    10/10
    bitratpersistencetrojanupxxenarmorcollectionpasswordrecoveryspywarestealer

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • BitRAT Payload

    • XenArmor Suite

      XenArmor is as suite of password recovery tools for various application.

      recoverypasswordxenarmor

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks