Overview

overview

8

Static

static

3d95e6885d...fb.exe

windows7-x64

8

3d95e6885d...fb.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    3d95e6885d4a0a66dad5d37750fa84a4d4f1f9db2ccc741997d22d89af92cbfb

  • Size

    210KB

  • Sample

    221027-falwzaafhp

  • MD5

    1ff6aa04bc4971019ecd9220847a8986

  • SHA1

    9bf32b9710a1fc088d831c0d88c6c02579ffbffa

  • SHA256

    3d95e6885d4a0a66dad5d37750fa84a4d4f1f9db2ccc741997d22d89af92cbfb

  • SHA512

    161d92bc46abe4b94d2eb1c394e2ee1530d9af7936fbbae3580f4870b8ac08db522fcf300b502350ff4dcad976e9e32c296a7c9be71964e8dfa06164bbd0a358

  • SSDEEP

    3072:l+QC2mCJvErJUHYait2hQvnc+bz3GaPwISE+qOJvvqarP9JeRhLnzC8ThzCyHV:Kl+it2D+bl+q23HrPDeR1fR

Score
8/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      3d95e6885d4a0a66dad5d37750fa84a4d4f1f9db2ccc741997d22d89af92cbfb

    • Size

      210KB

    • MD5

      1ff6aa04bc4971019ecd9220847a8986

    • SHA1

      9bf32b9710a1fc088d831c0d88c6c02579ffbffa

    • SHA256

      3d95e6885d4a0a66dad5d37750fa84a4d4f1f9db2ccc741997d22d89af92cbfb

    • SHA512

      161d92bc46abe4b94d2eb1c394e2ee1530d9af7936fbbae3580f4870b8ac08db522fcf300b502350ff4dcad976e9e32c296a7c9be71964e8dfa06164bbd0a358

    • SSDEEP

      3072:l+QC2mCJvErJUHYait2hQvnc+bz3GaPwISE+qOJvvqarP9JeRhLnzC8ThzCyHV:Kl+it2D+bl+q23HrPDeR1fR

    Score
    8/10
    evasionpersistencespywarestealer

    • Executes dropped EXE

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks