Overview

overview

10

Static

static

8

bf206cf227...53.exe

windows7-x64

10

bf206cf227...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf206cf227d665e825516b60621a04439de1d4c20066125182a8cb9e3a6f1053

  • Size

    1.9MB

  • Sample

    221128-ckkj4sfg64

  • MD5

    06aae2bd4563087a593cf510beb06497

  • SHA1

    1bff7fb0d665427a2bbed220093ac5dfb366a0f7

  • SHA256

    bf206cf227d665e825516b60621a04439de1d4c20066125182a8cb9e3a6f1053

  • SHA512

    1ca2e4df790b2202bbb0a05fb3257cc36f01511ba1aa01497cde7c6a436988d913323f57945c3d042c9b58eecdcab54fc41fac9018653f70627d3a5ca9a95404

  • SSDEEP

    1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      bf206cf227d665e825516b60621a04439de1d4c20066125182a8cb9e3a6f1053

    • Size

      1.9MB

    • MD5

      06aae2bd4563087a593cf510beb06497

    • SHA1

      1bff7fb0d665427a2bbed220093ac5dfb366a0f7

    • SHA256

      bf206cf227d665e825516b60621a04439de1d4c20066125182a8cb9e3a6f1053

    • SHA512

      1ca2e4df790b2202bbb0a05fb3257cc36f01511ba1aa01497cde7c6a436988d913323f57945c3d042c9b58eecdcab54fc41fac9018653f70627d3a5ca9a95404

    • SSDEEP

      1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

    Score
    10/10
    evasionpersistencespywarestealertrojanupx

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks