Overview

overview

8

Static

static

25537a39bf...35.exe

windows7-x64

8

25537a39bf...35.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25537a39bf55401c4513eb71e741d159083a00d3f762e860f02d02d840356135

  • Size

    4.3MB

  • Sample

    221125-ebnxaada2z

  • MD5

    edc0d8201cb4d2fbe02f95d1d14416a9

  • SHA1

    d4ebf17050da1036e849cce38659c365c83f3d7b

  • SHA256

    25537a39bf55401c4513eb71e741d159083a00d3f762e860f02d02d840356135

  • SHA512

    6e0fb581b9bb0f8acc5ece76b51f20c5ee60910494a87ac7da2e3cbd789b4e50a17c3b0d9abbf1bcc2bf2ca8770864ce004653085e60e4adfd76f878e87f3df3

  • SSDEEP

    49152:bUuKYWYG/n0JOKLmxup4fdGKvghxfki1Kc7SK7NDyoC3yE/Ac5mWxnmEP:AjYGcAK5KcN7SKEoWNAxenj

Score
8/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      25537a39bf55401c4513eb71e741d159083a00d3f762e860f02d02d840356135

    • Size

      4.3MB

    • MD5

      edc0d8201cb4d2fbe02f95d1d14416a9

    • SHA1

      d4ebf17050da1036e849cce38659c365c83f3d7b

    • SHA256

      25537a39bf55401c4513eb71e741d159083a00d3f762e860f02d02d840356135

    • SHA512

      6e0fb581b9bb0f8acc5ece76b51f20c5ee60910494a87ac7da2e3cbd789b4e50a17c3b0d9abbf1bcc2bf2ca8770864ce004653085e60e4adfd76f878e87f3df3

    • SSDEEP

      49152:bUuKYWYG/n0JOKLmxup4fdGKvghxfki1Kc7SK7NDyoC3yE/Ac5mWxnmEP:AjYGcAK5KcN7SKEoWNAxenj

    Score
    8/10
    adwarediscoverypersistencestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks