Overview

overview

8

Static

static

929ad412f2...e3.exe

windows7_x64

8

929ad412f2...e3.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3

  • Size

    24KB

  • Sample

    220427-smfxpsafc6

  • MD5

    58de1ef68aefc14928f13ada8ffdc7d6

  • SHA1

    746c48cbc7c6494a97eb51fc5653ea4d92067886

  • SHA256

    929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3

  • SHA512

    0dff73007502969838c2c3dd7c9f89775cad5a6d07f8acebe8660f376cfaf8c0e76cd3e68b65f04421139cad7225abebcdfc824ebcb9c4bdb81fcb1cac1841f7

Score
8/10
adwarestealer

Malware Config

Targets

    • Target

      929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3

    • Size

      24KB

    • MD5

      58de1ef68aefc14928f13ada8ffdc7d6

    • SHA1

      746c48cbc7c6494a97eb51fc5653ea4d92067886

    • SHA256

      929ad412f2ea75b80bbd11bfa2bac3bec3fd689b7f40a5674a9449f1846d79e3

    • SHA512

      0dff73007502969838c2c3dd7c9f89775cad5a6d07f8acebe8660f376cfaf8c0e76cd3e68b65f04421139cad7225abebcdfc824ebcb9c4bdb81fcb1cac1841f7

    Score
    8/10
    adwarestealer

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks