Overview

overview

10

Static

static

16dd45a566...bb.exe

windows7-x64

10

16dd45a566...bb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16dd45a566ea6c03f4aac69fbd451bbb.exe

  • Size

    185KB

  • Sample

    230119-d8sfasec59

  • MD5

    16dd45a566ea6c03f4aac69fbd451bbb

  • SHA1

    9a1561da84c775e3fda2e31c87afb784d651687f

  • SHA256

    9c05d6bfce786708b4534463b462b21472b87d71fbf491820db856f1f388e34d

  • SHA512

    53da04f2993e30a6338fe92454fe6bb642dcfedba3199f0a2d23ad9587e2ee6c8a480a54d4e0d312e6a62ffd45b8fc14d7fd1ff0bc22f0f3720561d4c79e1937

  • SSDEEP

    3072:sIqFseU5L+IqOhw6RYDgWLMm4snkWr9fP5oexvgzq+7FKGeEYG/YrfnKsjjTZjOn:sIqFQL+IuLMJsnfP5oexIzq+7FKGeEY+

Score
10/10
elysiumstealerevasionpersistencestealer

Malware Config

Targets

    • Target

      16dd45a566ea6c03f4aac69fbd451bbb.exe

    • Size

      185KB

    • MD5

      16dd45a566ea6c03f4aac69fbd451bbb

    • SHA1

      9a1561da84c775e3fda2e31c87afb784d651687f

    • SHA256

      9c05d6bfce786708b4534463b462b21472b87d71fbf491820db856f1f388e34d

    • SHA512

      53da04f2993e30a6338fe92454fe6bb642dcfedba3199f0a2d23ad9587e2ee6c8a480a54d4e0d312e6a62ffd45b8fc14d7fd1ff0bc22f0f3720561d4c79e1937

    • SSDEEP

      3072:sIqFseU5L+IqOhw6RYDgWLMm4snkWr9fP5oexvgzq+7FKGeEYG/YrfnKsjjTZjOn:sIqFQL+IuLMJsnfP5oexIzq+7FKGeEY+

    Score
    10/10
    elysiumstealerevasionpersistencestealer

    • ElysiumStealer

      ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

      stealerelysiumstealer

    • ElysiumStealer Support DLL

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks