Overview

overview

8

Static

static

e0d5e662bb...45.exe

windows7-x64

8

e0d5e662bb...45.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0d5e662bb29b62dc06e8c1c5ed07beb282ee6bb61b1fba4fb9393dd3cac4645.exe

  • Size

    39.8MB

  • Sample

    221005-rwva1seeg7

  • MD5

    e6e40ec931ee73bebf8eacf05f55b30e

  • SHA1

    66bfd894f485cf552def2d25808108ff55dd0189

  • SHA256

    e0d5e662bb29b62dc06e8c1c5ed07beb282ee6bb61b1fba4fb9393dd3cac4645

  • SHA512

    2b30f63f52d5b1e0ff65082d3a3af63b317e5c0b1cc22988ddc3abfdd4da247acb34be469a7bd4e87478fc437545c79e6dc149d6d645ce914e4d0dbf298386d3

  • SSDEEP

    786432:EeYtsO1bayaqfBZCvnAaqp5fMkq3FWGGdu35BCHJFzGhBLh1/Laxsx5QXe:E9V1baqfBZIAavkq3MGyuJKFahtLaCL/

Score
8/10
discoverypyinstallerspyware

Malware Config

Targets

    • Target

      e0d5e662bb29b62dc06e8c1c5ed07beb282ee6bb61b1fba4fb9393dd3cac4645.exe

    • Size

      39.8MB

    • MD5

      e6e40ec931ee73bebf8eacf05f55b30e

    • SHA1

      66bfd894f485cf552def2d25808108ff55dd0189

    • SHA256

      e0d5e662bb29b62dc06e8c1c5ed07beb282ee6bb61b1fba4fb9393dd3cac4645

    • SHA512

      2b30f63f52d5b1e0ff65082d3a3af63b317e5c0b1cc22988ddc3abfdd4da247acb34be469a7bd4e87478fc437545c79e6dc149d6d645ce914e4d0dbf298386d3

    • SSDEEP

      786432:EeYtsO1bayaqfBZCvnAaqp5fMkq3FWGGdu35BCHJFzGhBLh1/Laxsx5QXe:E9V1baqfBZIAavkq3MGyuJKFahtLaCL/

    Score
    8/10
    discoverypyinstallerspyware

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks