Overview

overview

10

Static

static

6edb0807b9...c2.exe

windows7-x64

10

6edb0807b9...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6edb0807b9e158ada139c75f4cdd8d1f3ffc4dd5be63855eb31e9f4f02d96cc2

  • Size

    872KB

  • Sample

    221126-v7z77aeh9z

  • MD5

    e1ab81aeeefdc09b1f2a4bd2128013dc

  • SHA1

    a627f111f71e9bb9798dfe9fa76911f2c7e73edf

  • SHA256

    6edb0807b9e158ada139c75f4cdd8d1f3ffc4dd5be63855eb31e9f4f02d96cc2

  • SHA512

    630f44562790992031b3072a37ee6043194c870a09ea3ed22e1cdfaf2da272f9415fe8e9c84a1aea5d15b3e8acca66e85040b7860aa6a3556de84fbaf86f1081

  • SSDEEP

    12288:PzTTMWshu7uRt3nAaXBOxNd5S6FNziE11p4Pvqw8++1uXfNCSzm5:Pxshe2tXAmBo5RFUE11yByuXfNCSzm

Score
10/10
collectionevasionspywarestealertrojan

Malware Config

Targets

    • Target

      6edb0807b9e158ada139c75f4cdd8d1f3ffc4dd5be63855eb31e9f4f02d96cc2

    • Size

      872KB

    • MD5

      e1ab81aeeefdc09b1f2a4bd2128013dc

    • SHA1

      a627f111f71e9bb9798dfe9fa76911f2c7e73edf

    • SHA256

      6edb0807b9e158ada139c75f4cdd8d1f3ffc4dd5be63855eb31e9f4f02d96cc2

    • SHA512

      630f44562790992031b3072a37ee6043194c870a09ea3ed22e1cdfaf2da272f9415fe8e9c84a1aea5d15b3e8acca66e85040b7860aa6a3556de84fbaf86f1081

    • SSDEEP

      12288:PzTTMWshu7uRt3nAaXBOxNd5S6FNziE11p4Pvqw8++1uXfNCSzm5:Pxshe2tXAmBo5RFUE11yByuXfNCSzm

    Score
    10/10
    collectionevasionspywarestealertrojan

    • UAC bypass

      evasiontrojan

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Drops file in Drivers directory

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks