Overview

overview

8

Static

static

1b8081bae0...20.exe

windows7_x64

8

1b8081bae0...20.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe

  • Size

    740KB

  • Sample

    220701-nhmggadafk

  • MD5

    95b62355385af3d2711b7a8e759ed664

  • SHA1

    6c66c4005b14c14a1029a601eeed55cab21ae713

  • SHA256

    1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420

  • SHA512

    2b32851fd222e4fc06748b1f6f1f9b6b9ffd1e7d95e5c2c8665de0d55a825cd1918763d2b0af0200c2332dd5c5b33a5fe1183dc565046a7f457a00c4bee180dd

Score
8/10
daveransomwarespywarestealer

Malware Config

Targets

    • Target

      1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420.exe

    • Size

      740KB

    • MD5

      95b62355385af3d2711b7a8e759ed664

    • SHA1

      6c66c4005b14c14a1029a601eeed55cab21ae713

    • SHA256

      1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420

    • SHA512

      2b32851fd222e4fc06748b1f6f1f9b6b9ffd1e7d95e5c2c8665de0d55a825cd1918763d2b0af0200c2332dd5c5b33a5fe1183dc565046a7f457a00c4bee180dd

    Score
    8/10
    daveransomwarespywarestealer

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks