Overview

overview

8

Static

static

6ad0e6641c...62.exe

windows7-x64

8

6ad0e6641c...62.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    6ad0e6641ce4fe788915148997fe09f09a206f8cb623d36fdad0ea32101f9c62

  • Size

    1.1MB

  • Sample

    221127-1bejhaad72

  • MD5

    1561007ee31af07e6c3339b182b56ce3

  • SHA1

    b1302cfe9a4d40c3f91992e7fd7fae7f4c14a90d

  • SHA256

    6ad0e6641ce4fe788915148997fe09f09a206f8cb623d36fdad0ea32101f9c62

  • SHA512

    7280b843eaba3eeea68f038654e71af7896c58ca9d4db3eefc654f47e6520f16c69c2cae1fe4ce2de3974dd10f9051479b59689d7810f52c5b30151af00a8f90

  • SSDEEP

    24576:6G6DaG0cC0Um7KvyNhXCV4E8BXAfrnkcAqU0AR2PIDvARG3FUD:6G6DaBPhYKv+hyz8grnkQfak+GGa

Score
8/10
adwarepersistencespywarestealer

Malware Config

Targets

    • Target

      6ad0e6641ce4fe788915148997fe09f09a206f8cb623d36fdad0ea32101f9c62

    • Size

      1.1MB

    • MD5

      1561007ee31af07e6c3339b182b56ce3

    • SHA1

      b1302cfe9a4d40c3f91992e7fd7fae7f4c14a90d

    • SHA256

      6ad0e6641ce4fe788915148997fe09f09a206f8cb623d36fdad0ea32101f9c62

    • SHA512

      7280b843eaba3eeea68f038654e71af7896c58ca9d4db3eefc654f47e6520f16c69c2cae1fe4ce2de3974dd10f9051479b59689d7810f52c5b30151af00a8f90

    • SSDEEP

      24576:6G6DaG0cC0Um7KvyNhXCV4E8BXAfrnkcAqU0AR2PIDvARG3FUD:6G6DaBPhYKv+hyz8grnkQfak+GGa

    Score
    8/10
    adwarepersistencespywarestealer

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks