Overview

overview

8

Static

static

e6b55a49e2...d3.exe

windows7-x64

8

e6b55a49e2...d3.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e6b55a49e2100484a52db67bcc217f0cb839816b3593dd5ddeca71d589cb64d3

  • Size

    4.3MB

  • Sample

    221124-v9jm8adc3y

  • MD5

    de9980286d5acaeb3b324395ccbcaa5a

  • SHA1

    358e019ad56f7237199cf08e608a5ae1741464fd

  • SHA256

    e6b55a49e2100484a52db67bcc217f0cb839816b3593dd5ddeca71d589cb64d3

  • SHA512

    fe55974bb850bdba7f76ac8d35417c87c1558d096c8e61f0f27c738038ab20c2e728595927fc1a0f3cfca3edc5853e71270c0980bb4138b51a43e312d3304f4b

  • SSDEEP

    49152:vPjAWsZC9dtAZVvpgu3twXNFHCq/j31a0/cD7HpTVPhoKfX3jFkCsLZfJHar541:8WsZRLeXNFHCq/j31a0/cD7Hj5oKO

Score
8/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      e6b55a49e2100484a52db67bcc217f0cb839816b3593dd5ddeca71d589cb64d3

    • Size

      4.3MB

    • MD5

      de9980286d5acaeb3b324395ccbcaa5a

    • SHA1

      358e019ad56f7237199cf08e608a5ae1741464fd

    • SHA256

      e6b55a49e2100484a52db67bcc217f0cb839816b3593dd5ddeca71d589cb64d3

    • SHA512

      fe55974bb850bdba7f76ac8d35417c87c1558d096c8e61f0f27c738038ab20c2e728595927fc1a0f3cfca3edc5853e71270c0980bb4138b51a43e312d3304f4b

    • SSDEEP

      49152:vPjAWsZC9dtAZVvpgu3twXNFHCq/j31a0/cD7HpTVPhoKfX3jFkCsLZfJHar541:8WsZRLeXNFHCq/j31a0/cD7Hj5oKO

    Score
    8/10
    adwarediscoverypersistencestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks