807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def | Triage

Submit
Reports

Overview

overview

8

Static

static

807acec31a...ef.exe

windows7-x64

8

807acec31a...ef.exe

windows10-2004-x64

8

Sharing

General

Target

807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def
Size

164KB
Sample

221201-cyaxtsba4v
MD5

af431c0c3adf46014458ceab54723b94
SHA1

bf28fe1071db5da2772b8b0214f64d2e45c75176
SHA256

807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def
SHA512

d8c7d889a713803618ae82196b81e0b0d62c1aa78a7cb16c0e18e77dc2c36079a251ebed4736bc6751d6dfc5d0bc278adc8df8f37d00abbace527374d8ba5870
SSDEEP

3072:uNW5t+OHJPXvXR30BThuF0/WNrJ+Se8KBNX9gutnA8eTkGapK:ug5nHRvalBWCnBNX92kT

Score

8^/10

persistence spyware stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def.exe

Resource

win7-20221111-en

persistence spyware stealer upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def.exe

Resource

win10v2004-20220812-en

persistence spyware stealer upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def
- Size
  
  164KB
- MD5
  
  af431c0c3adf46014458ceab54723b94
- SHA1
  
  bf28fe1071db5da2772b8b0214f64d2e45c75176
- SHA256
  
  807acec31a4cf4983978cbc090ec43fe4b69f103afaeaea97702ad4cd18b4def
- SHA512
  
  d8c7d889a713803618ae82196b81e0b0d62c1aa78a7cb16c0e18e77dc2c36079a251ebed4736bc6751d6dfc5d0bc278adc8df8f37d00abbace527374d8ba5870
- SSDEEP
  
  3072:uNW5t+OHJPXvXR30BThuF0/WNrJ+Se8KBNX9gutnA8eTkGapK:ug5nHRvalBWCnBNX92kT
Score

8^/10

persistence spyware stealer upx
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealerupx

behavioral2

persistencespywarestealerupx

© 2018-2024

Terms | Privacy