Overview

overview

10

Static

static

6f270dfb7e...c1.exe

windows7-x64

10

6f270dfb7e...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f270dfb7ee7af893bb929f4b41f4a5426cddde47d6e146103242608bb9081c1

  • Size

    726KB

  • Sample

    221106-x78knshag2

  • MD5

    04351af2a551f4f14beb8d850fd915c0

  • SHA1

    a93ba76a363ccf8a68b745571d8938fd47c3ac5d

  • SHA256

    6f270dfb7ee7af893bb929f4b41f4a5426cddde47d6e146103242608bb9081c1

  • SHA512

    267f54d286de1dc58bff60ae071aaeb82e9345d70630765347ac5559740ac78d3e13e195ec923e47c6388828bfd6a093c99fb771bc5a258452ab4a82b84f6187

  • SSDEEP

    12288:uj48qMjoA5SXeGLYOpfzopwyjsz3sp1c/b9weqKhovbP+wdMkqY:ujLqMkAxg150sbsg/b9wnKhAP+oL

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      6f270dfb7ee7af893bb929f4b41f4a5426cddde47d6e146103242608bb9081c1

    • Size

      726KB

    • MD5

      04351af2a551f4f14beb8d850fd915c0

    • SHA1

      a93ba76a363ccf8a68b745571d8938fd47c3ac5d

    • SHA256

      6f270dfb7ee7af893bb929f4b41f4a5426cddde47d6e146103242608bb9081c1

    • SHA512

      267f54d286de1dc58bff60ae071aaeb82e9345d70630765347ac5559740ac78d3e13e195ec923e47c6388828bfd6a093c99fb771bc5a258452ab4a82b84f6187

    • SSDEEP

      12288:uj48qMjoA5SXeGLYOpfzopwyjsz3sp1c/b9weqKhovbP+wdMkqY:ujLqMkAxg150sbsg/b9wnKhAP+oL

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks