Overview

overview

8

Static

static

a5d4b2c497...e4.exe

windows7-x64

8

a5d4b2c497...e4.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4

  • Size

    4.3MB

  • Sample

    221124-z3dkvadd2s

  • MD5

    ccdc0150b7d3ad18eeb151d8071016a3

  • SHA1

    33ac9cae63bd68ee1d96d19bdf20c9a8dd182dd4

  • SHA256

    a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4

  • SHA512

    913c44419edb0c7ac7e57a5974c3dd834ebcb09f6687111b4a20968becb4378341b06d7f99b8a47d047e95c3a3e7bf1e513bce0299e78ff22b6160176fc3f8bb

  • SSDEEP

    49152:EUEvXcbN7MdNBR/PBfltMqdMxR+w2UduyiV4vO6yiMPn+7d0agxpA:37MRR1FMnlduyiV4v1nMPn+7

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4

    • Size

      4.3MB

    • MD5

      ccdc0150b7d3ad18eeb151d8071016a3

    • SHA1

      33ac9cae63bd68ee1d96d19bdf20c9a8dd182dd4

    • SHA256

      a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4

    • SHA512

      913c44419edb0c7ac7e57a5974c3dd834ebcb09f6687111b4a20968becb4378341b06d7f99b8a47d047e95c3a3e7bf1e513bce0299e78ff22b6160176fc3f8bb

    • SSDEEP

      49152:EUEvXcbN7MdNBR/PBfltMqdMxR+w2UduyiV4vO6yiMPn+7d0agxpA:37MRR1FMnlduyiV4v1nMPn+7

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks