Overview

overview

10

Static

static

Mouse Reco...NZ.exe

windows7_x64

10

Mouse Reco...NZ.exe

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Mouse Recorder Premium _TbJNZ.exe

  • Size

    5.1MB

  • Sample

    220623-avbc3sdhc5

  • MD5

    5347d1465f1abfbe142bee26234c2d42

  • SHA1

    43aa39e7c91122fac3ceff37278f878eb60df870

  • SHA256

    3eeab0e2bbd7e74117cf4d36fa98a7d0125fc46161a1193f0b72fca297f5c8ac

  • SHA512

    afe6c2b058056813ef2f6642c5e4593c37bfc12b38f7f8990e3a923e56922a7c2647eb2e214d7da22de60648475bf59b2b3a9f4818f2861dbc37f9f8e10815bd

Score
10/10
discoveryevasionspywarestealersuricata

Malware Config

Targets

    • Target

      Mouse Recorder Premium _TbJNZ.exe

    • Size

      5.1MB

    • MD5

      5347d1465f1abfbe142bee26234c2d42

    • SHA1

      43aa39e7c91122fac3ceff37278f878eb60df870

    • SHA256

      3eeab0e2bbd7e74117cf4d36fa98a7d0125fc46161a1193f0b72fca297f5c8ac

    • SHA512

      afe6c2b058056813ef2f6642c5e4593c37bfc12b38f7f8990e3a923e56922a7c2647eb2e214d7da22de60648475bf59b2b3a9f4818f2861dbc37f9f8e10815bd

    Score
    10/10
    discoveryevasionspywarestealersuricata

    • suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

      suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

      suricata

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks