Overview

overview

8

Static

static

44e5e7661a...88.exe

windows7-x64

8

44e5e7661a...88.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44e5e7661a6efbb4d6b2f7f7e107b24879cc0cd9132dd5b85e1a881a69f14888

  • Size

    4.3MB

  • Sample

    221124-h8z8csgf68

  • MD5

    9a33d64867936ef1c846391d2c839f99

  • SHA1

    275b3d6ac948180975e37ad46c9f19c636fbb167

  • SHA256

    44e5e7661a6efbb4d6b2f7f7e107b24879cc0cd9132dd5b85e1a881a69f14888

  • SHA512

    31d11329b386859c6ecfac2321f99290ef81d56f87d311d07f427b6f225d4e82f45099db85035bf88892710b00d17cded1aa88386f2e8ed0eeb41144a340d848

  • SSDEEP

    49152:lSuK4jZ0WHCpNqLmxup4QdGKvghxfki1kOCrZguQnyjSlM/Zf0weeDNxAr:k2Z0NvqaKcpWZgAj8MNtLNxA

Score
8/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      44e5e7661a6efbb4d6b2f7f7e107b24879cc0cd9132dd5b85e1a881a69f14888

    • Size

      4.3MB

    • MD5

      9a33d64867936ef1c846391d2c839f99

    • SHA1

      275b3d6ac948180975e37ad46c9f19c636fbb167

    • SHA256

      44e5e7661a6efbb4d6b2f7f7e107b24879cc0cd9132dd5b85e1a881a69f14888

    • SHA512

      31d11329b386859c6ecfac2321f99290ef81d56f87d311d07f427b6f225d4e82f45099db85035bf88892710b00d17cded1aa88386f2e8ed0eeb41144a340d848

    • SSDEEP

      49152:lSuK4jZ0WHCpNqLmxup4QdGKvghxfki1kOCrZguQnyjSlM/Zf0weeDNxAr:k2Z0NvqaKcpWZgAj8MNtLNxA

    Score
    8/10
    adwarediscoverypersistencestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks