Overview

overview

8

Static

static

8

db9e7cbd83...06.exe

windows7_x64

8

db9e7cbd83...06.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db9e7cbd83ba39269ca1bdcd0950ff8d620511999d66d9ecea3c572d40aea506

  • Size

    4.2MB

  • Sample

    220521-m36keadaa7

  • MD5

    37370eceaf48033001671cb3566e0927

  • SHA1

    47941e3b617b2f5e59a3e313694f2c7422569698

  • SHA256

    db9e7cbd83ba39269ca1bdcd0950ff8d620511999d66d9ecea3c572d40aea506

  • SHA512

    9c574967b1e07f304730e87df8c99419ca3c94b20b5fad408a8ec9b0c89f39426cd02bc3b5b21bac49ca62a431eda16761e417ac75b1407d31c8a038b13a63d4

Score
8/10
persistencespywarestealerupxvmprotect

Malware Config

Targets

    • Target

      db9e7cbd83ba39269ca1bdcd0950ff8d620511999d66d9ecea3c572d40aea506

    • Size

      4.2MB

    • MD5

      37370eceaf48033001671cb3566e0927

    • SHA1

      47941e3b617b2f5e59a3e313694f2c7422569698

    • SHA256

      db9e7cbd83ba39269ca1bdcd0950ff8d620511999d66d9ecea3c572d40aea506

    • SHA512

      9c574967b1e07f304730e87df8c99419ca3c94b20b5fad408a8ec9b0c89f39426cd02bc3b5b21bac49ca62a431eda16761e417ac75b1407d31c8a038b13a63d4

    Score
    8/10
    persistencespywarestealerupxvmprotect

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks