Overview

overview

8

Static

static

eb5044852b...6b.exe

windows7-x64

8

eb5044852b...6b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb5044852b3a095c0313fdefc58921796581d96cb78f67e65fbbe03b1f55636b

  • Size

    4.4MB

  • Sample

    221124-vzlptshd98

  • MD5

    680be8e7a055aadd4749ecf9ed2f6462

  • SHA1

    888c2bc2b7c23555631f8283ef6577b6e8d4d9ca

  • SHA256

    eb5044852b3a095c0313fdefc58921796581d96cb78f67e65fbbe03b1f55636b

  • SHA512

    5488b2fda89191f79be07d0c76d5436c01c83e99507197fb156d58bad1a452a5d7971384b1e5e11141437b114e44b78f970ad7e57fdd3502641ac813a61e1a72

  • SSDEEP

    49152:yu2K6lZs3xgKchpUxup4DV3XOjKzuFYdk29buOBqFtZ8hpTQdWB:pSZsqth4OjK9kibuOBqFtZspsdW

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      eb5044852b3a095c0313fdefc58921796581d96cb78f67e65fbbe03b1f55636b

    • Size

      4.4MB

    • MD5

      680be8e7a055aadd4749ecf9ed2f6462

    • SHA1

      888c2bc2b7c23555631f8283ef6577b6e8d4d9ca

    • SHA256

      eb5044852b3a095c0313fdefc58921796581d96cb78f67e65fbbe03b1f55636b

    • SHA512

      5488b2fda89191f79be07d0c76d5436c01c83e99507197fb156d58bad1a452a5d7971384b1e5e11141437b114e44b78f970ad7e57fdd3502641ac813a61e1a72

    • SSDEEP

      49152:yu2K6lZs3xgKchpUxup4DV3XOjKzuFYdk29buOBqFtZ8hpTQdWB:pSZsqth4OjK9kibuOBqFtZspsdW

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks