Overview

overview

8

Static

static

7

jre-8u45-w...86.exe

windows7-x64

8

jre-8u45-w...86.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jre-8u45-windows-i586.exe

  • Size

    35.6MB

  • Sample

    230408-x8yf4aeh39

  • MD5

    c95a3764d1d13f88ff7b6b745054dc03

  • SHA1

    7fc89bd7f82a092d2aa15b753f1fa17e47b879aa

  • SHA256

    8dc948d6a95aaeaf5915b47cb73ecbc55c543d6f0db5f4e85e5e805be6ef3ee2

  • SHA512

    d415a02a513ca93ba48a1ecf73bc4dd06875b8d7d3690b1329e622a8dc784afc24e577d55d8c8f2c694d0e8ebc12df76c67f9431328fe33c46a7e0d6132758ac

  • SSDEEP

    786432:Mrq/xQqa86SLuVBlhXj2btm5TR6TIVArbC47Kxgzo7itF6j:D/xQqaGLY6m58TIV0ho7imj

Score
8/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      jre-8u45-windows-i586.exe

    • Size

      35.6MB

    • MD5

      c95a3764d1d13f88ff7b6b745054dc03

    • SHA1

      7fc89bd7f82a092d2aa15b753f1fa17e47b879aa

    • SHA256

      8dc948d6a95aaeaf5915b47cb73ecbc55c543d6f0db5f4e85e5e805be6ef3ee2

    • SHA512

      d415a02a513ca93ba48a1ecf73bc4dd06875b8d7d3690b1329e622a8dc784afc24e577d55d8c8f2c694d0e8ebc12df76c67f9431328fe33c46a7e0d6132758ac

    • SSDEEP

      786432:Mrq/xQqa86SLuVBlhXj2btm5TR6TIVArbC47Kxgzo7itF6j:D/xQqaGLY6m58TIV0ho7imj

    Score
    8/10
    adwarepersistencestealerupx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks