Overview

overview

8

Static

static

fef4dc75cf...1d.exe

windows7-x64

8

fef4dc75cf...1d.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fef4dc75cff4ebd2678a4e1ab7705635accd605e8f1b4723761c238eeb48c91d

  • Size

    2.5MB

  • Sample

    221124-tv3xwaac7s

  • MD5

    8d5f88e53569874630284d48be8ebb8a

  • SHA1

    7c2d3cfbcb471f21c6a82be60c50dca1e0dd5d7d

  • SHA256

    fef4dc75cff4ebd2678a4e1ab7705635accd605e8f1b4723761c238eeb48c91d

  • SHA512

    94fc3d4d82f6649c40bc209af03a9baf6f59717a3dee74194fd2abfb93e99c8ae5abdf0cde91724184d656f2ed423c5ce553d3550dfdb159086f027682a1c67e

  • SSDEEP

    49152:h1OstCpYO/dJJDHhs6oxRkNfehWfNs4VGufZ9JODSTz4bkP:h1OLly7kNfrNq4P

Score
8/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      fef4dc75cff4ebd2678a4e1ab7705635accd605e8f1b4723761c238eeb48c91d

    • Size

      2.5MB

    • MD5

      8d5f88e53569874630284d48be8ebb8a

    • SHA1

      7c2d3cfbcb471f21c6a82be60c50dca1e0dd5d7d

    • SHA256

      fef4dc75cff4ebd2678a4e1ab7705635accd605e8f1b4723761c238eeb48c91d

    • SHA512

      94fc3d4d82f6649c40bc209af03a9baf6f59717a3dee74194fd2abfb93e99c8ae5abdf0cde91724184d656f2ed423c5ce553d3550dfdb159086f027682a1c67e

    • SSDEEP

      49152:h1OstCpYO/dJJDHhs6oxRkNfehWfNs4VGufZ9JODSTz4bkP:h1OLly7kNfrNq4P

    Score
    8/10
    adwarediscoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks