Overview

overview

8

Static

static

3c2a05de8b...73.exe

windows7-x64

8

3c2a05de8b...73.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c2a05de8bda2667a7b2d8fd7b5c83cc8700fe4f538068b9833a92a65f4f4473

  • Size

    96KB

  • Sample

    221125-jw61taga7z

  • MD5

    27ff32c344a76c1edb3162c29a935939

  • SHA1

    98205461d906246f98ddee08239f2249b2bff653

  • SHA256

    3c2a05de8bda2667a7b2d8fd7b5c83cc8700fe4f538068b9833a92a65f4f4473

  • SHA512

    57c4bb753e9a70dd11106b3768ea0da7be23f00c6134c987db7c9e01f4b4f36bddadac81cfec3891f202128107e00c5be91f4003bf036b8ea60dd7682234bb6c

  • SSDEEP

    1536:d/BmvfcnC2ph7jQR5MFoiZEtOUmatVKlXjO7HUEotQtGDewYWe3:d/2uje5MFoFClXS7EQtGDDDm

Score
8/10
persistencespywarestealer

Malware Config

Targets

    • Target

      3c2a05de8bda2667a7b2d8fd7b5c83cc8700fe4f538068b9833a92a65f4f4473

    • Size

      96KB

    • MD5

      27ff32c344a76c1edb3162c29a935939

    • SHA1

      98205461d906246f98ddee08239f2249b2bff653

    • SHA256

      3c2a05de8bda2667a7b2d8fd7b5c83cc8700fe4f538068b9833a92a65f4f4473

    • SHA512

      57c4bb753e9a70dd11106b3768ea0da7be23f00c6134c987db7c9e01f4b4f36bddadac81cfec3891f202128107e00c5be91f4003bf036b8ea60dd7682234bb6c

    • SSDEEP

      1536:d/BmvfcnC2ph7jQR5MFoiZEtOUmatVKlXjO7HUEotQtGDewYWe3:d/2uje5MFoFClXS7EQtGDDDm

    Score
    8/10
    persistencespywarestealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks