Overview

overview

9

Static

static

5b25ef51a2...16.exe

windows7-x64

9

5b25ef51a2...16.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16

  • Size

    819KB

  • Sample

    221125-1zdbcadb7y

  • MD5

    3fabe8f4e16f5e8b3df2992d4ba71c47

  • SHA1

    c156a8928ddff7c1009cfcb6c87bca6a788d8d0a

  • SHA256

    5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16

  • SHA512

    a033a8e1b74daf7adfbe797373e1c1a9ff9a761538377de855655fc8e4350e3646e25cf870b9a4f5c16d45d5e43f7742c80ec46b8a175c84959944564cb3fa2a

  • SSDEEP

    24576:v2O/GliJMDVMZpqa/brHkNbuvrl+YXOUs:ZUpEbzkN4xdOp

Score
9/10
aspackv2persistencespywarestealerupx

Malware Config

Targets

    • Target

      5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16

    • Size

      819KB

    • MD5

      3fabe8f4e16f5e8b3df2992d4ba71c47

    • SHA1

      c156a8928ddff7c1009cfcb6c87bca6a788d8d0a

    • SHA256

      5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16

    • SHA512

      a033a8e1b74daf7adfbe797373e1c1a9ff9a761538377de855655fc8e4350e3646e25cf870b9a4f5c16d45d5e43f7742c80ec46b8a175c84959944564cb3fa2a

    • SSDEEP

      24576:v2O/GliJMDVMZpqa/brHkNbuvrl+YXOUs:ZUpEbzkN4xdOp

    Score
    9/10
    aspackv2persistencespywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks