Overview

overview

8

Static

static

d1bbea57c5...20.exe

windows7-x64

8

d1bbea57c5...20.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1bbea57c5b0c7d1b08ff921a1524353c323a7692c6fdc5571979d5104255e20

  • Size

    316KB

  • Sample

    221123-p998aagd91

  • MD5

    953aa86de9d62d974497010aabd665ed

  • SHA1

    ab184b2ad827c980582bf2399fba39a53904bd8c

  • SHA256

    d1bbea57c5b0c7d1b08ff921a1524353c323a7692c6fdc5571979d5104255e20

  • SHA512

    541d26d65766a6e9ba4737d1d12efd83c37b9f53c32f4bcca8f7ddfacb7af6bd9863ce6de614c6f4f2efdf6efd374969ebee8cc86db88ef914c9b1d68bca04d4

  • SSDEEP

    3072:jImWY8geeqNlkvqGejAOS6p6ZXTedakBgOl0QuXJTYHkjPf0vax8gI5:8mW/Fxl81np6pKDe6Ol0bXJCkDWKS5

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      d1bbea57c5b0c7d1b08ff921a1524353c323a7692c6fdc5571979d5104255e20

    • Size

      316KB

    • MD5

      953aa86de9d62d974497010aabd665ed

    • SHA1

      ab184b2ad827c980582bf2399fba39a53904bd8c

    • SHA256

      d1bbea57c5b0c7d1b08ff921a1524353c323a7692c6fdc5571979d5104255e20

    • SHA512

      541d26d65766a6e9ba4737d1d12efd83c37b9f53c32f4bcca8f7ddfacb7af6bd9863ce6de614c6f4f2efdf6efd374969ebee8cc86db88ef914c9b1d68bca04d4

    • SSDEEP

      3072:jImWY8geeqNlkvqGejAOS6p6ZXTedakBgOl0QuXJTYHkjPf0vax8gI5:8mW/Fxl81np6pKDe6Ol0bXJCkDWKS5

    Score
    8/10
    discoverypersistencespywarestealerupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks