Overview

overview

8

Static

static

9dcfd18e48...b6.exe

windows7-x64

8

9dcfd18e48...b6.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9dcfd18e4852821e2e50c88280f3e65871b1305365b8d6ecb143e99b8a6b18b6

  • Size

    1.3MB

  • Sample

    221126-233wvafc8v

  • MD5

    d1419eff023dfb87f7c42ff34f0db69e

  • SHA1

    f6078a7944119f9776a56b6163f508cb98feb463

  • SHA256

    9dcfd18e4852821e2e50c88280f3e65871b1305365b8d6ecb143e99b8a6b18b6

  • SHA512

    c5a1cdf1c02bb1c113cf5a8074e4bfafb91296bb0a83f804b912e0e1f3e479b2448992a386574aeb282d495e2ecf70feba03d1d1a077bc3790144fb84730ddbd

  • SSDEEP

    24576:6NX1ul9XVFq7MjYiRCXiFgeHF+XIVYcDWuw2O:MsFI7h9SFgel+4Dw

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      9dcfd18e4852821e2e50c88280f3e65871b1305365b8d6ecb143e99b8a6b18b6

    • Size

      1.3MB

    • MD5

      d1419eff023dfb87f7c42ff34f0db69e

    • SHA1

      f6078a7944119f9776a56b6163f508cb98feb463

    • SHA256

      9dcfd18e4852821e2e50c88280f3e65871b1305365b8d6ecb143e99b8a6b18b6

    • SHA512

      c5a1cdf1c02bb1c113cf5a8074e4bfafb91296bb0a83f804b912e0e1f3e479b2448992a386574aeb282d495e2ecf70feba03d1d1a077bc3790144fb84730ddbd

    • SSDEEP

      24576:6NX1ul9XVFq7MjYiRCXiFgeHF+XIVYcDWuw2O:MsFI7h9SFgel+4Dw

    Score
    8/10
    discoverypersistencespywarestealerupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks