Overview

overview

8

Static

static

a6ecbad4a7...f3.exe

windows7-x64

8

a6ecbad4a7...f3.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6ecbad4a7ac456d29c410fc26e43382c30baa41b016cd9b009f8822c8f12ff3

  • Size

    2.5MB

  • Sample

    221124-z1hrsadb9x

  • MD5

    7858610cf31cc66135fd37b63a337c5f

  • SHA1

    1515bf6e990a1ce665ae9ce9a348d065905e8554

  • SHA256

    a6ecbad4a7ac456d29c410fc26e43382c30baa41b016cd9b009f8822c8f12ff3

  • SHA512

    4cd6b5d1b13135ac973f0636bb5d43a7dc2418fca9242b7813b7eda4e13c8db49d2227f691bc17230158c34bce71d66d7a89f9851b412c9bb9af540f2cc564d5

  • SSDEEP

    49152:h1OshjFsF6BIZ6OR+zs1JpLSy8TamBBYiHNqesoDSeiFmLm7Ec/:h1OcFsFfSdamBBCJ

Score
8/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      a6ecbad4a7ac456d29c410fc26e43382c30baa41b016cd9b009f8822c8f12ff3

    • Size

      2.5MB

    • MD5

      7858610cf31cc66135fd37b63a337c5f

    • SHA1

      1515bf6e990a1ce665ae9ce9a348d065905e8554

    • SHA256

      a6ecbad4a7ac456d29c410fc26e43382c30baa41b016cd9b009f8822c8f12ff3

    • SHA512

      4cd6b5d1b13135ac973f0636bb5d43a7dc2418fca9242b7813b7eda4e13c8db49d2227f691bc17230158c34bce71d66d7a89f9851b412c9bb9af540f2cc564d5

    • SSDEEP

      49152:h1OshjFsF6BIZ6OR+zs1JpLSy8TamBBYiHNqesoDSeiFmLm7Ec/:h1OcFsFfSdamBBCJ

    Score
    8/10
    adwarediscoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks