Overview

overview

8

Static

static

182d01af54...eb.exe

windows7-x64

8

182d01af54...eb.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb

  • Size

    722KB

  • Sample

    221123-zr6ggsdf58

  • MD5

    8e910184cbe93a98e107ef6eb7809004

  • SHA1

    ce5525f237cf0d9a01ced51874ccbf83ca9321bf

  • SHA256

    182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb

  • SHA512

    08abac662dbafcf129f19723fd557ba0fd2d02753726c65e350e7080c2ae84be9fe8f7e42e22b8866021ac651c127070086c148dc69037da003b7cdbc4c7d040

  • SSDEEP

    12288:t81Ed0hYcVhenSZ/8H45yo96jxrE05xdm/KFtUmuX/BoAUEaZuT5On:t81EdVcVYSZncJZEqqEUZPBoAUEKuT52

Score
8/10
persistencespywarestealer

Malware Config

Targets

    • Target

      182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb

    • Size

      722KB

    • MD5

      8e910184cbe93a98e107ef6eb7809004

    • SHA1

      ce5525f237cf0d9a01ced51874ccbf83ca9321bf

    • SHA256

      182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb

    • SHA512

      08abac662dbafcf129f19723fd557ba0fd2d02753726c65e350e7080c2ae84be9fe8f7e42e22b8866021ac651c127070086c148dc69037da003b7cdbc4c7d040

    • SSDEEP

      12288:t81Ed0hYcVhenSZ/8H45yo96jxrE05xdm/KFtUmuX/BoAUEaZuT5On:t81EdVcVYSZncJZEqqEUZPBoAUEKuT52

    Score
    8/10
    persistencespywarestealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks