Overview

overview

9

Static

static

8

1ca76a478b...bf.exe

windows7-x64

9

1ca76a478b...bf.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    1ca76a478be9f40cad6caa93b7d64274736f5f862438debfc1450690700d95bf

  • Size

    797KB

  • Sample

    221125-xcwbvsag2v

  • MD5

    72bfd9674f8735dedc0e813f89daf3c6

  • SHA1

    bbffd525f599d5cc85e07ea986417061234cf0ed

  • SHA256

    1ca76a478be9f40cad6caa93b7d64274736f5f862438debfc1450690700d95bf

  • SHA512

    3f21bc6615e370ac829d03eca246a6da32a8ef980e5379fc77e8bcd84a9408a97068315862d460f524d5296213013825b32ff28c3c40313b599c0a8d7c623df3

  • SSDEEP

    12288:nX73CiLA/V0D5YA7GLv3EZvu8zKGkDSd2BbATvB+uhH8iX0PAboSBXQG5l6Ij/uJ:nXHqV0D5HeEZvu8zpSU8UH8iEPtIjWIy

Score
9/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      1ca76a478be9f40cad6caa93b7d64274736f5f862438debfc1450690700d95bf

    • Size

      797KB

    • MD5

      72bfd9674f8735dedc0e813f89daf3c6

    • SHA1

      bbffd525f599d5cc85e07ea986417061234cf0ed

    • SHA256

      1ca76a478be9f40cad6caa93b7d64274736f5f862438debfc1450690700d95bf

    • SHA512

      3f21bc6615e370ac829d03eca246a6da32a8ef980e5379fc77e8bcd84a9408a97068315862d460f524d5296213013825b32ff28c3c40313b599c0a8d7c623df3

    • SSDEEP

      12288:nX73CiLA/V0D5YA7GLv3EZvu8zKGkDSd2BbATvB+uhH8iX0PAboSBXQG5l6Ij/uJ:nXHqV0D5HeEZvu8zpSU8UH8iEPtIjWIy

    Score
    9/10
    upxadwarepersistencestealer

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Detect jar appended to MSI

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks