Overview

overview

10

Static

static

16c2eca9f2...10.exe

windows7-x64

10

16c2eca9f2...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16c2eca9f2f50fe31c8c8ff9eb1cff719aa8fff9e77b37f22a6829c62c769410

  • Size

    670KB

  • Sample

    221125-2k27lacb28

  • MD5

    5f0f3b5dcbd27b8f3934f384450086bb

  • SHA1

    ba87d32df44d97bd231f568369bac31d891b9159

  • SHA256

    16c2eca9f2f50fe31c8c8ff9eb1cff719aa8fff9e77b37f22a6829c62c769410

  • SHA512

    35f79bc5556c0ec7750971a067115568e22847a3ee40e4a79cdd664056e782743a33359f8ae21e78568fe8f22c7f66d9be6ad56c4cd45fd5d868e38901a605f1

  • SSDEEP

    12288:X3nZMhJ+ubNUpl9J86HqNUJ5YBoHZ2U24wW3vcGbjfBWq/Y6LFnXdgInFBSS5cqT:X3nZqfbGT9J5bCBo5x2/W30GvJWxqQmd

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      16c2eca9f2f50fe31c8c8ff9eb1cff719aa8fff9e77b37f22a6829c62c769410

    • Size

      670KB

    • MD5

      5f0f3b5dcbd27b8f3934f384450086bb

    • SHA1

      ba87d32df44d97bd231f568369bac31d891b9159

    • SHA256

      16c2eca9f2f50fe31c8c8ff9eb1cff719aa8fff9e77b37f22a6829c62c769410

    • SHA512

      35f79bc5556c0ec7750971a067115568e22847a3ee40e4a79cdd664056e782743a33359f8ae21e78568fe8f22c7f66d9be6ad56c4cd45fd5d868e38901a605f1

    • SSDEEP

      12288:X3nZMhJ+ubNUpl9J86HqNUJ5YBoHZ2U24wW3vcGbjfBWq/Y6LFnXdgInFBSS5cqT:X3nZqfbGT9J5bCBo5x2/W30GvJWxqQmd

    Score
    10/10
    evasionpersistencespywarestealertrojanupx

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks