8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab | Triage

Submit
Reports

Overview

overview

Static

static

8

8fede6deb4...ab.exe

windows7-x64

8fede6deb4...ab.exe

windows10-2004-x64

Sharing

General

Target

8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab
Size

87KB
Sample

220919-e1z1vacahq
MD5

8964caa661358908ed89c5b635b0ce51
SHA1

f78dc6da226ebf00d2570626b5221ba74e710662
SHA256

8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab
SHA512

9cae722163e314bd469e40681bd649c6494261256099495cc1e185bc6851b4ea6946efa677c99e3e511defef634d5c8978914b8869be0c6feeee72eb0b092a00
SSDEEP

1536:UN6uBK9mVEQGCB6pZa6RGEN8XxWQchH33bYPDs5s35Tzdn:UN6uE9PQtB6pZa6RJCXxWhX3bYPD2spt

Score

10^/10

adware persistence stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab.exe

Resource

win7-20220901-en

adware persistence stealer upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab.exe

Resource

win10v2004-20220812-en

adware persistence stealer upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab
- Size
  
  87KB
- MD5
  
  8964caa661358908ed89c5b635b0ce51
- SHA1
  
  f78dc6da226ebf00d2570626b5221ba74e710662
- SHA256
  
  8fede6deb4f290fa9c296c3c7e097e9551178c88d3f2372af233b7fe279fb9ab
- SHA512
  
  9cae722163e314bd469e40681bd649c6494261256099495cc1e185bc6851b4ea6946efa677c99e3e511defef634d5c8978914b8869be0c6feeee72eb0b092a00
- SSDEEP
  
  1536:UN6uBK9mVEQGCB6pZa6RGEN8XxWQchH33bYPDs5s35Tzdn:UN6uE9PQtB6pZa6RJCXxWhX3bYPD2spt
Score

10^/10

adware persistence stealer upx
- Modifies WinLogon for persistence
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealerupx

behavioral2

adwarepersistencestealerupx

© 2018-2025

Terms | Privacy