Overview

overview

10

Static

static

4f03bfe5ef...c4.exe

windows7-x64

10

4f03bfe5ef...c4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4f03bfe5ef616bff88b9573bb0d694a9572183c8865fdcfe1d3b90922baae5c4

  • Size

    439KB

  • Sample

    221011-ntqy2acgck

  • MD5

    490a13953c77bdc891b2627384c192a0

  • SHA1

    a40fd38f87419bbe2485ea7df7224d5a2109d953

  • SHA256

    4f03bfe5ef616bff88b9573bb0d694a9572183c8865fdcfe1d3b90922baae5c4

  • SHA512

    63c5d18b75f973d64d09117ad10a0497d06da2eb65f4aa3234c47bad0e139677979a8baed3cb6a7af52549c73917afaf11a05dc6e2331e1e7061e73f7d30f83d

  • SSDEEP

    12288:LBJYsjOpPsoDjMNy40b1tkHhpBeQE5L+QOtOeH0p:YMOP3jMEFb1tk/7AO4D

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      4f03bfe5ef616bff88b9573bb0d694a9572183c8865fdcfe1d3b90922baae5c4

    • Size

      439KB

    • MD5

      490a13953c77bdc891b2627384c192a0

    • SHA1

      a40fd38f87419bbe2485ea7df7224d5a2109d953

    • SHA256

      4f03bfe5ef616bff88b9573bb0d694a9572183c8865fdcfe1d3b90922baae5c4

    • SHA512

      63c5d18b75f973d64d09117ad10a0497d06da2eb65f4aa3234c47bad0e139677979a8baed3cb6a7af52549c73917afaf11a05dc6e2331e1e7061e73f7d30f83d

    • SSDEEP

      12288:LBJYsjOpPsoDjMNy40b1tkHhpBeQE5L+QOtOeH0p:YMOP3jMEFb1tk/7AO4D

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks