Overview

overview

10

Static

static

10

3e7a244279...3c.exe

windows7_x64

8

3e7a244279...3c.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c

  • Size

    12.4MB

  • Sample

    220311-aemq6sgcgl

  • MD5

    8d7bc30e8f1256b3a1a447e6cf8de012

  • SHA1

    26e266cb7f8b5dc4826d487c1e3bbfe78dfdb87b

  • SHA256

    3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c

  • SHA512

    6e44c6f3ee7614fb286daf80d14ab16d28a5aaca6edcc8db4ca421e991cc583189419271fb23860895726bc29211c8ead4b8edae253dfddaf4493139aa71b692

Score
10/10
revengeratspywarestealervmprotect

Malware Config

Targets

    • Target

      3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c

    • Size

      12.4MB

    • MD5

      8d7bc30e8f1256b3a1a447e6cf8de012

    • SHA1

      26e266cb7f8b5dc4826d487c1e3bbfe78dfdb87b

    • SHA256

      3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c

    • SHA512

      6e44c6f3ee7614fb286daf80d14ab16d28a5aaca6edcc8db4ca421e991cc583189419271fb23860895726bc29211c8ead4b8edae253dfddaf4493139aa71b692

    Score
    8/10
    vmprotectspywarestealer

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks