Overview

overview

8

Static

static

7f9e525d73...46.exe

windows7-x64

8

7f9e525d73...46.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f9e525d730ee999125159a6778afc48de4ecb31af7bee895180400b081f8f46

  • Size

    4.5MB

  • Sample

    221124-255hfseg65

  • MD5

    1f8c885eebcacc77160984ea79d2c57e

  • SHA1

    1209b9473f47c4a478001091c17f188b9acdb2a6

  • SHA256

    7f9e525d730ee999125159a6778afc48de4ecb31af7bee895180400b081f8f46

  • SHA512

    11421cd3a282121c1272fa1d52a333b163a9c4b9d35ce01478d556767e62012258f42b5f8c227155ca1a1d18e932fa5a830c13cf63ef50504795a394f0851be8

  • SSDEEP

    49152:hIaK6pJEqd+Ti0Haxup49RCOdGKvghxfki1P9buOBqFoZ8hpTQddB:6OJEf20xKcvbuOBqFoZspsdd

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      7f9e525d730ee999125159a6778afc48de4ecb31af7bee895180400b081f8f46

    • Size

      4.5MB

    • MD5

      1f8c885eebcacc77160984ea79d2c57e

    • SHA1

      1209b9473f47c4a478001091c17f188b9acdb2a6

    • SHA256

      7f9e525d730ee999125159a6778afc48de4ecb31af7bee895180400b081f8f46

    • SHA512

      11421cd3a282121c1272fa1d52a333b163a9c4b9d35ce01478d556767e62012258f42b5f8c227155ca1a1d18e932fa5a830c13cf63ef50504795a394f0851be8

    • SSDEEP

      49152:hIaK6pJEqd+Ti0Haxup49RCOdGKvghxfki1P9buOBqFoZ8hpTQddB:6OJEf20xKcvbuOBqFoZspsdd

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks