6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb | Triage

Submit
Reports

Overview

overview

8

Static

static

6bcd87cefa...eb.exe

windows7-x64

8

6bcd87cefa...eb.exe

windows10-2004-x64

8

Sharing

General

Target

6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb
Size

1.1MB
Sample

221129-j3kq6aed2z
MD5

eb1ccd60d1f6285579157c99d465ad0c
SHA1

08f43493ed783c2c55a47e20828ffe4c29a91d60
SHA256

6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb
SHA512

df9ee7bb7d2f6472aad53551da224c7d19235e6744db582e9013b88117d8c7702c6a9653ce1f1f7548055628bac231848833c048db3800ef7be6946395d0b045
SSDEEP

12288:2cMWCFwg093BHnGyDvW2MeIy308uAhkhoWTCDY4YfsOEuCu/6oUldFOFiDI8amEG:fMWCFGxmyDyS301huY1T9f/DUzDszm

Score

8^/10

discovery persistence spyware stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb.exe

Resource

win7-20220812-en

discovery persistence spyware stealer upx

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb.exe

Resource

win10v2004-20220812-en

discovery persistence spyware stealer upx

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb
- Size
  
  1.1MB
- MD5
  
  eb1ccd60d1f6285579157c99d465ad0c
- SHA1
  
  08f43493ed783c2c55a47e20828ffe4c29a91d60
- SHA256
  
  6bcd87cefa92f204c4cac2da4b2fdc809acfd01b9664d589e2e787c6110010eb
- SHA512
  
  df9ee7bb7d2f6472aad53551da224c7d19235e6744db582e9013b88117d8c7702c6a9653ce1f1f7548055628bac231848833c048db3800ef7be6946395d0b045
- SSDEEP
  
  12288:2cMWCFwg093BHnGyDvW2MeIy308uAhkhoWTCDY4YfsOEuCu/6oUldFOFiDI8amEG:fMWCFGxmyDyS301huY1T9f/DUzDszm
Score

8^/10

discovery persistence spyware stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2

discoverypersistencespywarestealerupx

© 2018-2024

Terms | Privacy