Overview

overview

8

Static

static

8

ea896db7bd...72.exe

windows7-x64

8

ea896db7bd...72.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea896db7bdc4a2d8dd6a166d8f85715aebab079ce6b6c9dbac1c377f96f84572

  • Size

    2.0MB

  • Sample

    221107-dxckpshacn

  • MD5

    800160b7654bdc1f5e012e84b7520e0a

  • SHA1

    08788bdefeb70b0cc7e238eef1b7259a46be3c5b

  • SHA256

    ea896db7bdc4a2d8dd6a166d8f85715aebab079ce6b6c9dbac1c377f96f84572

  • SHA512

    f1a387e3b3201099177c30ddf0ceca14212346a133621f8ddb91271d3588b6ce74eae9d45079695290ce4761438f28ef4a22d0fe0a71403bd06959c24ae93242

  • SSDEEP

    49152:7v+ewt98OYlRsvxwUQdZVEocD7vR6+vSmHxyoE+p8HDE:L+ewtq0v1sZG3DD4sDvEy8HDE

Score
8/10
spywarestealerupxvmprotect

Malware Config

Targets

    • Target

      ea896db7bdc4a2d8dd6a166d8f85715aebab079ce6b6c9dbac1c377f96f84572

    • Size

      2.0MB

    • MD5

      800160b7654bdc1f5e012e84b7520e0a

    • SHA1

      08788bdefeb70b0cc7e238eef1b7259a46be3c5b

    • SHA256

      ea896db7bdc4a2d8dd6a166d8f85715aebab079ce6b6c9dbac1c377f96f84572

    • SHA512

      f1a387e3b3201099177c30ddf0ceca14212346a133621f8ddb91271d3588b6ce74eae9d45079695290ce4761438f28ef4a22d0fe0a71403bd06959c24ae93242

    • SSDEEP

      49152:7v+ewt98OYlRsvxwUQdZVEocD7vR6+vSmHxyoE+p8HDE:L+ewtq0v1sZG3DD4sDvEy8HDE

    Score
    8/10
    spywarestealerupxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks