c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c | Triage

Submit
Reports

Overview

overview

Static

static

c4f3e53e80...5c.exe

windows7-x64

c4f3e53e80...5c.exe

windows10-2004-x64

Sharing

General

Target

c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c
Size

693KB
Sample

221002-serdgabfg7
MD5

7418800e921a8309cdefc04f9ec4b871
SHA1

0533cf54a5f3c90ec637582da03d0266fad04297
SHA256

c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c
SHA512

aabbbec362e6522b29a29c07e09ad181140cfd88a62ae01849115b398945a2eee4dced8f63cbed0cdfba3aca2e08788d3320d2ddf2ae467066c30691e491ce7e
SSDEEP

12288:inaKawSQQ+G5Z5syS5syS5syC+G5sy8eeeQ+AM5syS5Z5Z5Z5Beu:ai22w8eeesAMeu

Score

10^/10

adware persistence stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c.exe

Resource

win7-20220901-en

adware persistence stealer upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c.exe

Resource

win10v2004-20220901-en

adware persistence stealer upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c
- Size
  
  693KB
- MD5
  
  7418800e921a8309cdefc04f9ec4b871
- SHA1
  
  0533cf54a5f3c90ec637582da03d0266fad04297
- SHA256
  
  c4f3e53e8090f707c53a1c4ebab49a5c3376034e3cfaa9c8745a3a4c8cf6c65c
- SHA512
  
  aabbbec362e6522b29a29c07e09ad181140cfd88a62ae01849115b398945a2eee4dced8f63cbed0cdfba3aca2e08788d3320d2ddf2ae467066c30691e491ce7e
- SSDEEP
  
  12288:inaKawSQQ+G5Z5syS5syS5syC+G5sy8eeeQ+AM5syS5Z5Z5Z5Beu:ai22w8eeesAMeu
Score

10^/10

adware persistence stealer upx
- Modifies WinLogon for persistence
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealerupx

behavioral2

adwarepersistencestealerupx

© 2018-2025

Terms | Privacy