Overview

overview

8

Static

static

cd132aaa80...94.exe

windows7-x64

8

cd132aaa80...94.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094

  • Size

    272KB

  • Sample

    221124-ashdlsad7t

  • MD5

    555f54e8f462a161e327996503e31735

  • SHA1

    486dd61f4d9adc110b32806ebadc73bcfbf262e5

  • SHA256

    cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094

  • SHA512

    3caa845e16dda17a5a3b1587f4e1f489078aa371371c3f7b0554d1b857d2b7586f1ced38c4d9c570a155043d12be2d97e798c846d151b0ad4706f1dd1635c12e

  • SSDEEP

    6144:0j94Szj94Szj94Szj94Szj94Szj94Szj94Szj94Szj9q:0jiSzjiSzjiSzjiSzjiSzjiSzjiSzjiL

Score
8/10
spywarestealer

Malware Config

Targets

    • Target

      cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094

    • Size

      272KB

    • MD5

      555f54e8f462a161e327996503e31735

    • SHA1

      486dd61f4d9adc110b32806ebadc73bcfbf262e5

    • SHA256

      cd132aaa8038961ebd255fbc6f982944e98f889a00d1c5966c8dffca0e2f4094

    • SHA512

      3caa845e16dda17a5a3b1587f4e1f489078aa371371c3f7b0554d1b857d2b7586f1ced38c4d9c570a155043d12be2d97e798c846d151b0ad4706f1dd1635c12e

    • SSDEEP

      6144:0j94Szj94Szj94Szj94Szj94Szj94Szj94Szj94Szj9q:0jiSzjiSzjiSzjiSzjiSzjiSzjiSzjiL

    Score
    8/10
    spywarestealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks