Overview

overview

8

Static

static

eaeb7541e0...ea.exe

windows7-x64

8

eaeb7541e0...ea.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaeb7541e030c05a36a7f08fc1b4b0245bd943538104a0f0f6adad29540c04ea

  • Size

    812KB

  • Sample

    221123-s5escsda97

  • MD5

    ef3b323ba1d2632dcd4f916b607b01f8

  • SHA1

    fce4edeaea484a3c577a7015f9431ffec33bb880

  • SHA256

    eaeb7541e030c05a36a7f08fc1b4b0245bd943538104a0f0f6adad29540c04ea

  • SHA512

    3d47781d07bbf0482c4a3bfa5b4d87dd959ad50819fdfe2be5020428c72c32968f6fa17b04642f6abb7ffe8ede85198fb3bd8a7bd1e788e96e1b2d78d78e2416

  • SSDEEP

    12288:fyyaiQP9xLfe4HX+x21qMzNT4eXnMb9F12+qnZIui9Gx9Kio0GJtaMZ7SIev:CiSXL2Gn1qkNT48nMb3gyGbnGf9SI

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      eaeb7541e030c05a36a7f08fc1b4b0245bd943538104a0f0f6adad29540c04ea

    • Size

      812KB

    • MD5

      ef3b323ba1d2632dcd4f916b607b01f8

    • SHA1

      fce4edeaea484a3c577a7015f9431ffec33bb880

    • SHA256

      eaeb7541e030c05a36a7f08fc1b4b0245bd943538104a0f0f6adad29540c04ea

    • SHA512

      3d47781d07bbf0482c4a3bfa5b4d87dd959ad50819fdfe2be5020428c72c32968f6fa17b04642f6abb7ffe8ede85198fb3bd8a7bd1e788e96e1b2d78d78e2416

    • SSDEEP

      12288:fyyaiQP9xLfe4HX+x21qMzNT4eXnMb9F12+qnZIui9Gx9Kio0GJtaMZ7SIev:CiSXL2Gn1qkNT48nMb3gyGbnGf9SI

    Score
    8/10
    discoverypersistencespywarestealerupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks