Overview

overview

8

Static

static

d6afcfb03b...33.exe

windows7-x64

8

d6afcfb03b...33.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6afcfb03ba7fd6dfb005f70684587646cc1a300e2ffe8425ede3bb56e250b33

  • Size

    1.6MB

  • Sample

    221125-kk7zeaeb83

  • MD5

    2d7dc161bc1a8432ffabd77e6e9af669

  • SHA1

    c481d959a2e7660ab279775d0458be6684a7de65

  • SHA256

    d6afcfb03ba7fd6dfb005f70684587646cc1a300e2ffe8425ede3bb56e250b33

  • SHA512

    3e5c5db69178ced85b52a5273577458de4cb3e4ce731826849272f86be3c4f9266df76d84a9c846bc822c8cfcbc5eb6fc90559f7e7c5117cbd2f13eb1ef1b946

  • SSDEEP

    24576:rwyo3roDgLtU66nwEIyy/I2i0VcmeTGFiTYSVNVb+uGwRnND3SMsVqwtYa:kyo3DLtt6ni7I2iYeTGFiThVNNFFo7r

Score
8/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      d6afcfb03ba7fd6dfb005f70684587646cc1a300e2ffe8425ede3bb56e250b33

    • Size

      1.6MB

    • MD5

      2d7dc161bc1a8432ffabd77e6e9af669

    • SHA1

      c481d959a2e7660ab279775d0458be6684a7de65

    • SHA256

      d6afcfb03ba7fd6dfb005f70684587646cc1a300e2ffe8425ede3bb56e250b33

    • SHA512

      3e5c5db69178ced85b52a5273577458de4cb3e4ce731826849272f86be3c4f9266df76d84a9c846bc822c8cfcbc5eb6fc90559f7e7c5117cbd2f13eb1ef1b946

    • SSDEEP

      24576:rwyo3roDgLtU66nwEIyy/I2i0VcmeTGFiTYSVNVb+uGwRnND3SMsVqwtYa:kyo3DLtt6ni7I2iYeTGFiThVNNFFo7r

    Score
    8/10
    adwarediscoveryevasionpersistencestealertrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks