Overview

overview

9

Static

static

8

2216973fd9...80.exe

windows7_x64

9

2216973fd9...80.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80

  • Size

    17KB

  • Sample

    220427-wmcrtsfha8

  • MD5

    ac88cf156ecae3c17833d98e2d24cb89

  • SHA1

    4d238e454fd2c82d809f7dbd5117b16a6d7686a4

  • SHA256

    2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80

  • SHA512

    b2e54b89be1ed110e889fe228da238071c7db1f24e55dc8a37f73d54ee56d4728131fb7c8c277c5cdcc7629158cb8e58f55ab2aa0503523cad69a8483448821b

Score
9/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80

    • Size

      17KB

    • MD5

      ac88cf156ecae3c17833d98e2d24cb89

    • SHA1

      4d238e454fd2c82d809f7dbd5117b16a6d7686a4

    • SHA256

      2216973fd9794e1cca0ce543368762eb0105f5d097b103db52bd37731d790c80

    • SHA512

      b2e54b89be1ed110e889fe228da238071c7db1f24e55dc8a37f73d54ee56d4728131fb7c8c277c5cdcc7629158cb8e58f55ab2aa0503523cad69a8483448821b

    Score
    9/10
    adwarepersistencestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks