b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1 | Triage

Submit
Reports

Overview

overview

Static

static

b9078c0d7f...f1.exe

windows7-x64

8

b9078c0d7f...f1.exe

windows10-2004-x64

Sharing

General

Target

b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1
Size

3.0MB
Sample

221203-3x82cagf62
MD5

c2304d10fca46da64b7e4c91295f2d22
SHA1

92e66bacb7129f672d34b5f855b2a5b2721be2ee
SHA256

b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1
SHA512

f6db7a31fd6ab2fdeb5e1f4f99b945c749ae33f154da45f4f1cd1cf9705271374d10fffc46f88890b41e395560a5244843f443ff7fed279a732c4dd56a05e9e8
SSDEEP

49152:BdaaxdGvpwh7+UCSQTbHKlYtSFIZzg4ismy4keHFg5J7Daae3a6p+mTQYzcizg:/jxkBwha8Q/HKlYtQGvoA5J7DP3/YIb

Score

10^/10

evasion spyware stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1.exe

Resource

win7-20221111-en

spyware stealer upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1.exe

Resource

win10v2004-20221111-en

evasion spyware stealer upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1
- Size
  
  3.0MB
- MD5
  
  c2304d10fca46da64b7e4c91295f2d22
- SHA1
  
  92e66bacb7129f672d34b5f855b2a5b2721be2ee
- SHA256
  
  b9078c0d7f22c68e45f19bc5c9de1919f6a07f4cf85ccb8aa391d675e8e687f1
- SHA512
  
  f6db7a31fd6ab2fdeb5e1f4f99b945c749ae33f154da45f4f1cd1cf9705271374d10fffc46f88890b41e395560a5244843f443ff7fed279a732c4dd56a05e9e8
- SSDEEP
  
  49152:BdaaxdGvpwh7+UCSQTbHKlYtSFIZzg4ismy4keHFg5J7Daae3a6p+mTQYzcizg:/jxkBwha8Q/HKlYtQGvoA5J7DP3/YIb
Score

10^/10

spyware stealer upx evasion
- Modifies firewall policy service
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

spywarestealerupx

behavioral2

evasionspywarestealerupx

© 2018-2025

Terms | Privacy