Overview

overview

7

Static

static

3

rensenWare.exe

windows7-x64

7

rensenWare.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rensenWare.exe

  • Size

    850KB

  • Sample

    230513-a6gdgahb5y

  • MD5

    a2c251b29f91a9f2dd103d1cf4d3f642

  • SHA1

    c756853b930edc2f105985f9ef67de67079c7c1b

  • SHA256

    08e7dbcdca0fc27b535eebf80d4e2d8b9c164885b9e9d767819b8030abcfbeac

  • SHA512

    714ea3d43ed1910554f6e30d9a16c37f7b7469b81b0d278c0f92bf0c3e65109bcd917ca70fd029d4433ba6db717886d170ac16a73dc8c015ad48f54f53b30b37

  • SSDEEP

    12288:BMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Kk8L0iw1j:BnsJ39LyjbJkQFMhmC+6GD9d8L0iu

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      rensenWare.exe

    • Size

      850KB

    • MD5

      a2c251b29f91a9f2dd103d1cf4d3f642

    • SHA1

      c756853b930edc2f105985f9ef67de67079c7c1b

    • SHA256

      08e7dbcdca0fc27b535eebf80d4e2d8b9c164885b9e9d767819b8030abcfbeac

    • SHA512

      714ea3d43ed1910554f6e30d9a16c37f7b7469b81b0d278c0f92bf0c3e65109bcd917ca70fd029d4433ba6db717886d170ac16a73dc8c015ad48f54f53b30b37

    • SSDEEP

      12288:BMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Kk8L0iw1j:BnsJ39LyjbJkQFMhmC+6GD9d8L0iu

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks