Overview

overview

10

Static

static

568e50b972...1d.exe

windows7-x64

10

568e50b972...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    568e50b97207e7fa8229d4766010b7a844873b75c7ec28b4b0c8f61014df1f1d

  • Size

    8.8MB

  • Sample

    220725-c47trabecn

  • MD5

    ae719a973aef34b8a3fd1b79c95efb1f

  • SHA1

    a34c8ea551203ce6632cf2bf2590de563f364ec6

  • SHA256

    568e50b97207e7fa8229d4766010b7a844873b75c7ec28b4b0c8f61014df1f1d

  • SHA512

    f92ca09e509649839a8c217597f8fc10f1f00a281c1fba5429be744460267c875f02d066cdbf3cc977705c430731741af6aa1c61757347b7a502aac7914d13dc

Score
10/10
spywarestealersuricata

Malware Config

Targets

    • Target

      568e50b97207e7fa8229d4766010b7a844873b75c7ec28b4b0c8f61014df1f1d

    • Size

      8.8MB

    • MD5

      ae719a973aef34b8a3fd1b79c95efb1f

    • SHA1

      a34c8ea551203ce6632cf2bf2590de563f364ec6

    • SHA256

      568e50b97207e7fa8229d4766010b7a844873b75c7ec28b4b0c8f61014df1f1d

    • SHA512

      f92ca09e509649839a8c217597f8fc10f1f00a281c1fba5429be744460267c875f02d066cdbf3cc977705c430731741af6aa1c61757347b7a502aac7914d13dc

    Score
    10/10
    spywarestealersuricata

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks