Overview

overview

10

Static

static

8

fb9a9abcbc...c4.exe

windows7-x64

10

fb9a9abcbc...c4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb9a9abcbcce5503f2ba14b20cc5ac8ee939610cb63d5e82ea74e68be36c44c4

  • Size

    82KB

  • Sample

    221107-c3erksdcg5

  • MD5

    0470713caea9fc422a92f6fff5580941

  • SHA1

    2d9e9ce703e55a6c8d4f540b2557db027b30ac8a

  • SHA256

    fb9a9abcbcce5503f2ba14b20cc5ac8ee939610cb63d5e82ea74e68be36c44c4

  • SHA512

    4f4cb8eeac2e4a68065bea61a4a42330efecdbcd00344f089ad82b2829a0e22032acbc5153a453fc2dbd3ea3522e2a1e7996d83dfbca8d925b0d2db1b6d7c721

  • SSDEEP

    1536:HdfA/D3lHOK1is6gJKZO4wBDXPlAXhnzbxOFY3oECftwj7+7:9fpxJgJKE4wBDflGhzbIFY3oZ47+7

Score
10/10
evasionpersistencespywarestealerupx

Malware Config

Targets

    • Target

      fb9a9abcbcce5503f2ba14b20cc5ac8ee939610cb63d5e82ea74e68be36c44c4

    • Size

      82KB

    • MD5

      0470713caea9fc422a92f6fff5580941

    • SHA1

      2d9e9ce703e55a6c8d4f540b2557db027b30ac8a

    • SHA256

      fb9a9abcbcce5503f2ba14b20cc5ac8ee939610cb63d5e82ea74e68be36c44c4

    • SHA512

      4f4cb8eeac2e4a68065bea61a4a42330efecdbcd00344f089ad82b2829a0e22032acbc5153a453fc2dbd3ea3522e2a1e7996d83dfbca8d925b0d2db1b6d7c721

    • SSDEEP

      1536:HdfA/D3lHOK1is6gJKZO4wBDXPlAXhnzbxOFY3oECftwj7+7:9fpxJgJKE4wBDflGhzbIFY3oZ47+7

    Score
    10/10
    evasionpersistencespywarestealerupx

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks