Overview

overview

8

Static

static

IMG_5017_F...os.exe

windows7-x64

8

IMG_5017_F...os.exe

windows10-2004-x64

8

WDSync.dll

windows7-x64

1

WDSync.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    0a8e1df64f830a2c961ea3559d67465a4e83c4c16a0cc7d6920afe114fbc5d79

  • Size

    33.0MB

  • Sample

    230111-k7yn9afe8v

  • MD5

    cdf73b282b4815f652479ce9aa82f4af

  • SHA1

    bd7429f903a3f7235ae2050128c6dfc51b2d8f0d

  • SHA256

    0a8e1df64f830a2c961ea3559d67465a4e83c4c16a0cc7d6920afe114fbc5d79

  • SHA512

    2e69adb7f5496ba28d149ad68f7913914b7d6270376f35c86e4d88f8b61a5e9e7d76dd0d0b7870a3bec5a876c4b0df74cd9a457b51310fe2a70b657a022f9dc7

  • SSDEEP

    786432:A1H4xg5USPaa3tt94hpIiXyqbs0KAOKQIO/p6wy++cYlbZ4IM36a:A1H4MUSPLYpXyqcWOh6vAkbZ9a

Score
8/10
spywarestealer

Malware Config

Targets

    • Target

      IMG_5017_Full_Album_Photos_Beautiful_Girl_And_Pretty_Cute_Girls_By_Zhong_Zian_Studios.exe

    • Size

      153KB

    • MD5

      37932fd952d6d845927f25f42cb3c628

    • SHA1

      d0d7e1b7cfb13a0999ef4c4733b83275a1de2440

    • SHA256

      cb807472bb6d4d1113fcbc209d6a08fa80ff9e53c83b1aa37f9d6f549affd68c

    • SHA512

      403dce223d9cbb4241f21a773cfc55501e4141b161c3ba60397c75d533c3abbd420a8f526f6aac7f2a0a5b7b91361ed013641f0d40afc00680428db3c1dbb49b

    • SSDEEP

      1536:UJSV1Mq4KjdA0ejIB+7YeEsczbruUdwpiOpiq3hlV:UJKMq4KjdA0ejIB2sbbiUqhrV

    Score
    8/10
    spywarestealer

    • Executes dropped EXE

    • Patched UPX-packed file

      Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

    • Target

      WDSync.dll

    • Size

      32.3MB

    • MD5

      57a46c1496d4a7b1eacf865c29295e9a

    • SHA1

      6579bde0541ed3bd4b229bd6b1da8bbffbfdd58f

    • SHA256

      3112181e7847b4bd85fc638afb14a72bfb756c1a57f1b6f1d4ca45a83b2f3e29

    • SHA512

      022e68b92065ea2a6207aabce1fc6869d3602d57dfc42334aa3ecb76cd2ad0aeeccaa8c2d09ae9844be3aebc8e3f11ca99ad99386952b4886a233cefa49fb84b

    • SSDEEP

      786432:mJhixGbyEVeqHDXN6JhY0l0Of+OKWcKoGqlzGyo2YEuhPheGEdQ:mJhicyEVbghH0O4eqFGP0WPhJ

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks