Overview

overview

9

Static

static

8

7486f3997b...eb.exe

windows7-x64

9

7486f3997b...eb.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    7486f3997b1e8c0251a56a55c3baf912c4d26d0742ab4971dcfb5c4e4bd1d9eb

  • Size

    367KB

  • Sample

    221201-dqhhdadd4v

  • MD5

    20c6fdd28d1d45cde4e8d82dfb340edc

  • SHA1

    c8d693f0908addbec7476304a20e6eb01135adb2

  • SHA256

    7486f3997b1e8c0251a56a55c3baf912c4d26d0742ab4971dcfb5c4e4bd1d9eb

  • SHA512

    f068afeb2950617a19e52b6eb7e1b7c588c5a7599b9317481578d2c216226815a169de0e81bd83d147c0f8714ec304edcdd2ab0fdeb38bc9187c2fc2b637bb41

  • SSDEEP

    6144:er39L8zUhsZE8cZZ57E0PlON0Ih+XkJG0UMvndFqXuLyCxcolVxaKPJQA:er3B8oecZH6rh+axV7h157J

Score
9/10
collectiondiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      7486f3997b1e8c0251a56a55c3baf912c4d26d0742ab4971dcfb5c4e4bd1d9eb

    • Size

      367KB

    • MD5

      20c6fdd28d1d45cde4e8d82dfb340edc

    • SHA1

      c8d693f0908addbec7476304a20e6eb01135adb2

    • SHA256

      7486f3997b1e8c0251a56a55c3baf912c4d26d0742ab4971dcfb5c4e4bd1d9eb

    • SHA512

      f068afeb2950617a19e52b6eb7e1b7c588c5a7599b9317481578d2c216226815a169de0e81bd83d147c0f8714ec304edcdd2ab0fdeb38bc9187c2fc2b637bb41

    • SSDEEP

      6144:er39L8zUhsZE8cZZ57E0PlON0Ih+XkJG0UMvndFqXuLyCxcolVxaKPJQA:er3B8oecZH6rh+axV7h157J

    Score
    9/10
    collectiondiscoverypersistencespywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks