Overview

overview

8

Static

static

16babf419c...1c.exe

windows7-x64

8

16babf419c...1c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16babf419cb8afa2425a384883f258d97071d10c33e31f52412cd5cd0f15e41c

  • Size

    1.3MB

  • Sample

    221127-t55jfscb72

  • MD5

    8ac993d1df4908d7e6ed480045cfc819

  • SHA1

    6d3564e5a4866b284d41c7d80e07bcc9ed8f9fc2

  • SHA256

    16babf419cb8afa2425a384883f258d97071d10c33e31f52412cd5cd0f15e41c

  • SHA512

    8c3d7eabf94ce100eab364c1ca829ed333fc61b03970b8feb72b0cbc380976b59ffe01302afba97178c63228eb519d901a67e435df217ea7aaed94986e78d6e8

  • SSDEEP

    24576:kBjT6286vlKSljOIyMrcnZNT1iW97YQq7m0r6wK0Rs7yDaRvIU:t2V9OIGAW9rbc5Rs1vp

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      16babf419cb8afa2425a384883f258d97071d10c33e31f52412cd5cd0f15e41c

    • Size

      1.3MB

    • MD5

      8ac993d1df4908d7e6ed480045cfc819

    • SHA1

      6d3564e5a4866b284d41c7d80e07bcc9ed8f9fc2

    • SHA256

      16babf419cb8afa2425a384883f258d97071d10c33e31f52412cd5cd0f15e41c

    • SHA512

      8c3d7eabf94ce100eab364c1ca829ed333fc61b03970b8feb72b0cbc380976b59ffe01302afba97178c63228eb519d901a67e435df217ea7aaed94986e78d6e8

    • SSDEEP

      24576:kBjT6286vlKSljOIyMrcnZNT1iW97YQq7m0r6wK0Rs7yDaRvIU:t2V9OIGAW9rbc5Rs1vp

    Score
    8/10
    discoverypersistencespywarestealerupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks