Overview

overview

10

Static

static

f3b8625e35...c8.exe

windows7-x64

10

f3b8625e35...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3b8625e35ba798d61208eb9d75e0ca83e0a0c142423a372455476030ef011c8

  • Size

    108KB

  • Sample

    221127-xvxmmsbh33

  • MD5

    192c76e94a971c5951b114ddee7c6152

  • SHA1

    4f37224fe8cc8d1fec4037255868fe07718b4909

  • SHA256

    f3b8625e35ba798d61208eb9d75e0ca83e0a0c142423a372455476030ef011c8

  • SHA512

    23efaf9051eb1aece14e4430fe145b4f6ed5677613a93ee4f27d350bfaa85c76238eee4136dd5e413d29297ffccf2628985f89fdaec0171705135cc86449d2c3

  • SSDEEP

    1536:qo4Kalkc124vaaVKe1b2YdGSDBEfcCobsVqwRIJjtVInA0qbBlY4Zufpe:qtKa0NiKYdGS1iGcIBInv4BlSfpe

Score
10/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      f3b8625e35ba798d61208eb9d75e0ca83e0a0c142423a372455476030ef011c8

    • Size

      108KB

    • MD5

      192c76e94a971c5951b114ddee7c6152

    • SHA1

      4f37224fe8cc8d1fec4037255868fe07718b4909

    • SHA256

      f3b8625e35ba798d61208eb9d75e0ca83e0a0c142423a372455476030ef011c8

    • SHA512

      23efaf9051eb1aece14e4430fe145b4f6ed5677613a93ee4f27d350bfaa85c76238eee4136dd5e413d29297ffccf2628985f89fdaec0171705135cc86449d2c3

    • SSDEEP

      1536:qo4Kalkc124vaaVKe1b2YdGSDBEfcCobsVqwRIJjtVInA0qbBlY4Zufpe:qtKa0NiKYdGS1iGcIBInv4BlSfpe

    Score
    10/10
    evasionpersistencespywarestealer

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks