Overview

overview

10

Static

static

b005db2b41...9f.exe

windows7-x64

10

b005db2b41...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b005db2b415e0a8a1559fc6a5b937619e6896096e42e1c937bbb253e92425f9f

  • Size

    272KB

  • Sample

    221205-mr3pdabf98

  • MD5

    56376d90e5ecb6f45914ec7fbba862bd

  • SHA1

    c0143050cfcf30e23e0d64b66951a31d05edb67c

  • SHA256

    b005db2b415e0a8a1559fc6a5b937619e6896096e42e1c937bbb253e92425f9f

  • SHA512

    1a9db93718ab289a194a659943b016003b815395a37ebd874ebdc2d88b2cc92020aa9e6aab0cfd9a12be57546bb0ee3e943521ffc0beee84c14982f3df1f2e4d

  • SSDEEP

    6144:wASiBL1Y1NEYMRkjYLvFtSxOTdgW5FTl3XN+u/YerMoGtpGacB:wASiBL1Y1NEYMR3vDSxOqW5FxzGvGacB

Score
10/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      b005db2b415e0a8a1559fc6a5b937619e6896096e42e1c937bbb253e92425f9f

    • Size

      272KB

    • MD5

      56376d90e5ecb6f45914ec7fbba862bd

    • SHA1

      c0143050cfcf30e23e0d64b66951a31d05edb67c

    • SHA256

      b005db2b415e0a8a1559fc6a5b937619e6896096e42e1c937bbb253e92425f9f

    • SHA512

      1a9db93718ab289a194a659943b016003b815395a37ebd874ebdc2d88b2cc92020aa9e6aab0cfd9a12be57546bb0ee3e943521ffc0beee84c14982f3df1f2e4d

    • SSDEEP

      6144:wASiBL1Y1NEYMRkjYLvFtSxOTdgW5FTl3XN+u/YerMoGtpGacB:wASiBL1Y1NEYMR3vDSxOqW5FxzGvGacB

    Score
    10/10
    evasionpersistencespywarestealer

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks