Overview

overview

10

Static

static

7

setup_file/Setup.exe

windows7_x64

9

setup_file/Setup.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup_file.zip

  • Size

    7.5MB

  • Sample

    220629-sxzskaccd8

  • MD5

    03abd1e6f7f065e7044515adf39aa61f

  • SHA1

    026ecda4470679302a9e77a64b78e76d4005403a

  • SHA256

    d1d8da1470ea5f04a21126b7fab3887485f1bbba481ef7502ab40229585ffa84

  • SHA512

    7f14444661deb3c888087b8e196944bd89fbc6bf76306ca96bc47304acc43099afa8013e3347ad6d75eadf962828eddb09735828248b1c0a8d627df9b29d1d44

Score
10/10
discoveryevasionspywarestealersuricatathemidatrojan

Malware Config

Targets

    • Target

      setup_file/Setup.exe

    • Size

      399.8MB

    • MD5

      4c62beaa778c8e410cc3fa30459369af

    • SHA1

      2cb4f33daf55fd7216678b00146c05c87017c01f

    • SHA256

      833f4827b52da0076bdf133c06fe05d0b7dd5cf82902ffc79e932f0b94dfd02b

    • SHA512

      aed8397a33ce3629a5b0969a10587aa746ca7d9ebcb848872c8741095f92ee1c67100f1a92d9c5a90d86f1d179196078473191514b7335f43860b48f142b30ff

    Score
    10/10
    evasionthemidatrojandiscoveryspywarestealersuricata

    • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks