Overview

overview

8

Static

static

c1157c96d3...14.exe

windows7-x64

8

c1157c96d3...14.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814

  • Size

    1.9MB

  • Sample

    221125-z3fp7sfe28

  • MD5

    90d63f01ac77504bb55cbfd72e8ba186

  • SHA1

    f70b569e9c29684b36e4241f36b463f9d6aa03a2

  • SHA256

    c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814

  • SHA512

    5b855c8ab7438b703cb21146318ef6f0fbe0b408d74eff287e003a90c072e924cc1af2ca7cc9623fbc38df72db4ab8c84aa8cd6094845d4fdb30c8cec3a47b54

  • SSDEEP

    49152:GwHv9lt/SgRIpVQIIFJxGfVSDiQAU4KzPZTm19Gkt/:GwVlxSgRUKhGfApAUPz1mzGkt/

Score
8/10
adwareaspackv2discoverypersistencestealer

Malware Config

Targets

    • Target

      c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814

    • Size

      1.9MB

    • MD5

      90d63f01ac77504bb55cbfd72e8ba186

    • SHA1

      f70b569e9c29684b36e4241f36b463f9d6aa03a2

    • SHA256

      c1157c96d3f91dd1c71b6d3572a63ef6da2eec0981a8a54f36487f24e9421814

    • SHA512

      5b855c8ab7438b703cb21146318ef6f0fbe0b408d74eff287e003a90c072e924cc1af2ca7cc9623fbc38df72db4ab8c84aa8cd6094845d4fdb30c8cec3a47b54

    • SSDEEP

      49152:GwHv9lt/SgRIpVQIIFJxGfVSDiQAU4KzPZTm19Gkt/:GwVlxSgRUKhGfApAUPz1mzGkt/

    Score
    8/10
    adwareaspackv2discoverypersistencestealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks