Overview

overview

9

Static

static

04448dab08...f9.exe

windows7_x64

9

04448dab08...f9.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04448dab082af7a2cf4e6759308e94d3c78e686579ab2610169e1076739b81f9

  • Size

    250KB

  • Sample

    220527-1g81asdeh8

  • MD5

    1781b7d9e45b8330eb1f749af2ecc44f

  • SHA1

    7033c8a7138a702ae0850e653db0b9aba38fa6ca

  • SHA256

    04448dab082af7a2cf4e6759308e94d3c78e686579ab2610169e1076739b81f9

  • SHA512

    d94b3b2f6344a90b71703e1f6ef4b301c5bc42119a61eb9b131281b1ba09a2b4ce12b8f83115cd97062db80f295a4e1652e77fece97285c0dc555e63ba05822c

Score
9/10
adwarediscoveryspywarestealerupx

Malware Config

Targets

    • Target

      04448dab082af7a2cf4e6759308e94d3c78e686579ab2610169e1076739b81f9

    • Size

      250KB

    • MD5

      1781b7d9e45b8330eb1f749af2ecc44f

    • SHA1

      7033c8a7138a702ae0850e653db0b9aba38fa6ca

    • SHA256

      04448dab082af7a2cf4e6759308e94d3c78e686579ab2610169e1076739b81f9

    • SHA512

      d94b3b2f6344a90b71703e1f6ef4b301c5bc42119a61eb9b131281b1ba09a2b4ce12b8f83115cd97062db80f295a4e1652e77fece97285c0dc555e63ba05822c

    Score
    9/10
    adwarediscoveryspywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks