Overview

overview

9

Static

static

8

b5e4262e05...93.exe

windows7_x64

9

b5e4262e05...93.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5e4262e0583c962d4398240d933b4d43bd3173c386f256ef43d038fd097ba93

  • Size

    19KB

  • Sample

    220427-t84fkahddj

  • MD5

    c88605da04eed160b447040e7850e194

  • SHA1

    619a1dc5a737e952f694c630b99bc369a49b6300

  • SHA256

    b5e4262e0583c962d4398240d933b4d43bd3173c386f256ef43d038fd097ba93

  • SHA512

    7776aa35a7a750d2f092ddfd8181edf8ce8bd097724d36c60e5a2a09120985c36ceeed7f08f1ab893c25fbd9acb93aacdfb25e59f76f213f037c424f329bd2e2

Score
9/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      b5e4262e0583c962d4398240d933b4d43bd3173c386f256ef43d038fd097ba93

    • Size

      19KB

    • MD5

      c88605da04eed160b447040e7850e194

    • SHA1

      619a1dc5a737e952f694c630b99bc369a49b6300

    • SHA256

      b5e4262e0583c962d4398240d933b4d43bd3173c386f256ef43d038fd097ba93

    • SHA512

      7776aa35a7a750d2f092ddfd8181edf8ce8bd097724d36c60e5a2a09120985c36ceeed7f08f1ab893c25fbd9acb93aacdfb25e59f76f213f037c424f329bd2e2

    Score
    9/10
    adwarepersistencestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks