Overview

overview

8

Static

static

fb80b7a866...44.exe

windows7-x64

8

fb80b7a866...44.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb80b7a8660eb0d9974f55c6525806425ba085f4b601c1ed6250986bea7d8144

  • Size

    5.7MB

  • Sample

    221123-njgydaha43

  • MD5

    808bf2b225b20dcdeb5f7c43f10ebcea

  • SHA1

    235de26ef104f5c4da46a41181a5c0a7e80ce82d

  • SHA256

    fb80b7a8660eb0d9974f55c6525806425ba085f4b601c1ed6250986bea7d8144

  • SHA512

    8b7434a2e42f5b664b33de2fe65e25ec1690238629249bb67e33d7b0ca619962132d9467e3c2519d6b50598eb04dcdfa91da51d3cfa2f2f45ca9910071b62735

  • SSDEEP

    98304:JL+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95czg:989J/ANzywiJlgQNUJ2BTDYiqcAViVwM

Score
8/10
discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      fb80b7a8660eb0d9974f55c6525806425ba085f4b601c1ed6250986bea7d8144

    • Size

      5.7MB

    • MD5

      808bf2b225b20dcdeb5f7c43f10ebcea

    • SHA1

      235de26ef104f5c4da46a41181a5c0a7e80ce82d

    • SHA256

      fb80b7a8660eb0d9974f55c6525806425ba085f4b601c1ed6250986bea7d8144

    • SHA512

      8b7434a2e42f5b664b33de2fe65e25ec1690238629249bb67e33d7b0ca619962132d9467e3c2519d6b50598eb04dcdfa91da51d3cfa2f2f45ca9910071b62735

    • SSDEEP

      98304:JL+p957/mfkAb0JOyEmi+thHGAa0P9CQOGCfRJ2jlTDZ2l4wdcACdcruV95czg:989J/ANzywiJlgQNUJ2BTDYiqcAViVwM

    Score
    8/10
    discoverypersistencespywarestealer

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks