Overview

overview

8

Static

static

e350b05ac7...25.exe

windows7-x64

8

e350b05ac7...25.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e350b05ac7ab3fb07f1b293c85fc9cfce5a87d7e562e4694d6c2ae5abd3ef825

  • Size

    513KB

  • Sample

    221011-eejrqsdcc4

  • MD5

    684524dae890445c39102e1453108a30

  • SHA1

    4cdc83c2d02a27e6858ae3c25d55af43a933fec5

  • SHA256

    e350b05ac7ab3fb07f1b293c85fc9cfce5a87d7e562e4694d6c2ae5abd3ef825

  • SHA512

    46ab601a6806c7077f5424c95c63ee59c679fd6cdad37142c6c27d648595a0d706dc6414933293a83d961d090c7a35a6fc7c073eadb62599e30107a040a72739

  • SSDEEP

    12288:l9OeYXiVTn7n1V+3isxcplm6f+OWAS/4mer8mcwWd:6gn7n1V6iV/m6fbJIYpcw+

Score
8/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      e350b05ac7ab3fb07f1b293c85fc9cfce5a87d7e562e4694d6c2ae5abd3ef825

    • Size

      513KB

    • MD5

      684524dae890445c39102e1453108a30

    • SHA1

      4cdc83c2d02a27e6858ae3c25d55af43a933fec5

    • SHA256

      e350b05ac7ab3fb07f1b293c85fc9cfce5a87d7e562e4694d6c2ae5abd3ef825

    • SHA512

      46ab601a6806c7077f5424c95c63ee59c679fd6cdad37142c6c27d648595a0d706dc6414933293a83d961d090c7a35a6fc7c073eadb62599e30107a040a72739

    • SSDEEP

      12288:l9OeYXiVTn7n1V+3isxcplm6f+OWAS/4mer8mcwWd:6gn7n1V6iV/m6fbJIYpcw+

    Score
    8/10
    adwarepersistencestealerupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks