Overview

overview

8

Static

static

8

ea6a6d5981...10.exe

windows7-x64

7

ea6a6d5981...10.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea6a6d5981a0525a7179cccbd9a49cf4a8e76a03d092ac61ff7892da7e822110

  • Size

    2.1MB

  • Sample

    221128-be2qrsce83

  • MD5

    ad8dcda8253b4453c533484df10c4067

  • SHA1

    a744f19e200d9faad8753086aff9f5b04258f961

  • SHA256

    ea6a6d5981a0525a7179cccbd9a49cf4a8e76a03d092ac61ff7892da7e822110

  • SHA512

    06dec471502cf0907d8cea35feb3ab450bdef086009df92cb4df96e99b31a0f86442b06dfca03a936b0f5cc857faea26bb16170a0c5b1e610826794615666898

  • SSDEEP

    24576:iiIilDPUiIilDPeww5fL0vXlBsbSAOidYrovp4Tp9aQCoGsXHRL:1MD0vXlBMO+YrovpU/9L

Score
8/10
aspackv2persistencespywarestealer

Malware Config

Targets

    • Target

      ea6a6d5981a0525a7179cccbd9a49cf4a8e76a03d092ac61ff7892da7e822110

    • Size

      2.1MB

    • MD5

      ad8dcda8253b4453c533484df10c4067

    • SHA1

      a744f19e200d9faad8753086aff9f5b04258f961

    • SHA256

      ea6a6d5981a0525a7179cccbd9a49cf4a8e76a03d092ac61ff7892da7e822110

    • SHA512

      06dec471502cf0907d8cea35feb3ab450bdef086009df92cb4df96e99b31a0f86442b06dfca03a936b0f5cc857faea26bb16170a0c5b1e610826794615666898

    • SSDEEP

      24576:iiIilDPUiIilDPeww5fL0vXlBsbSAOidYrovp4Tp9aQCoGsXHRL:1MD0vXlBMO+YrovpU/9L

    Score
    7/10
    persistencespywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks