Overview

overview

10

Static

static

10

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2dc33d6d4b462753369840702ede9bd.bin

  • Size

    660KB

  • Sample

    230606-b112cscb3w

  • MD5

    a2dc33d6d4b462753369840702ede9bd

  • SHA1

    9e43fea19416ff11c59a5ceee9b6df604e6a7319

  • SHA256

    57429792c666371a9ea00fac44d9599847c807478c8a8c15fad9f481a84bd0ee

  • SHA512

    778c58173e2eb389c2aab8f8b8b8f2e3317420b943684628588dd64c24786277928f79358c33b65c4387528b63e0d98a969b8a4a5e29c0e65c565c796482078e

  • SSDEEP

    12288:TI0Ih+0FqBfPlE/stoIB0bc2XUMHLsYi5LYiONxX+Tqj5/WyjrxBJ8df2i9:TSUIqBfPuEtoSW1gYULYtNxX+Wj5/Wys

Score
10/10
privateloaderevasionspywarestealertrojan

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      1.6MB

    • MD5

      ce6eaa52767b2df78b34519231966588

    • SHA1

      ab32d09951189022a1a39e9204ec9ce2926b3fcf

    • SHA256

      40924781ba072ea88bd7cad3f6d2a48e87f370e1c1ee334a3415dd26b5ea17e5

    • SHA512

      36a09fe704823d6db5d0982d761ba1976c940b82b7c1ca650627d66e16b420612b78c761f2ed00e533453eeb2dd7e431cf47b0c2cf826354aa6e779fda531067

    • SSDEEP

      24576:Kqahn0IQ3i57AmG8W7+IZ0nwwoNR2+uBL8hxCMcIYwTxKAyuxCQyD2uG8wT5ngZx:KasHPBQxC/wTW2owTdIfpSKc

    Score
    10/10
    evasionspywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks