711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65 | Triage

Submit
Reports

Overview

overview

8

Static

static

711b8eae59...65.exe

windows7-x64

8

711b8eae59...65.exe

windows10-2004-x64

8

Sharing

General

Target

711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65
Size

244KB
Sample

221019-2hz98abdb7
MD5

90bb71d6b2ad3c4e69c134ae01cc1d80
SHA1

a1ee32519f77bf8af82f8134609da003f6d305ab
SHA256

711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65
SHA512

c2d7461bb2e4a09ce36e638239a72b3ff106c8424833e58b730c472f1d6b633cad781e58c92652d0ed99ad0a11ceca5130034f5a357b0655c130e693d2113b40
SSDEEP

3072:QjyQE1Jlrgku8X2rrP9/4Za5lq27nki3IMtnd9hh7DZUNaeqr6/qiFTqPsg:Qez92nPVAajnki3IMtd9WNafHil1g

Score

8^/10

discovery persistence spyware stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65.exe

Resource

win7-20220901-en

discovery persistence spyware stealer upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65.exe

Resource

win10v2004-20220812-en

discovery persistence spyware stealer upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65
- Size
  
  244KB
- MD5
  
  90bb71d6b2ad3c4e69c134ae01cc1d80
- SHA1
  
  a1ee32519f77bf8af82f8134609da003f6d305ab
- SHA256
  
  711b8eae591a1263be3bb9d7335d7aee131e6ec946d7b02d50bd4891d8691a65
- SHA512
  
  c2d7461bb2e4a09ce36e638239a72b3ff106c8424833e58b730c472f1d6b633cad781e58c92652d0ed99ad0a11ceca5130034f5a357b0655c130e693d2113b40
- SSDEEP
  
  3072:QjyQE1Jlrgku8X2rrP9/4Za5lq27nki3IMtnd9hh7DZUNaeqr6/qiFTqPsg:Qez92nPVAajnki3IMtd9WNafHil1g
Score

8^/10

discovery persistence spyware stealer upx
- Blocklisted process makes network request
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2

discoverypersistencespywarestealerupx

© 2018-2025

Terms | Privacy