Overview

overview

8

Static

static

1

PBCCRCPass...ge.exe

windows7-x64

8

PBCCRCPass...ge.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PBCCRCPassGuardEdge.exe.7z

  • Size

    2.7MB

  • Sample

    230623-2qk59shb89

  • MD5

    a7a45dfbc176d7edae3d9275c12429c9

  • SHA1

    713297a5d49bdaa36c7684509724651aac5f3056

  • SHA256

    48845030f7171d18d82990a179ea6cb2ab433a8c152fccd570584da16c0ffe83

  • SHA512

    8d55e456511b554079dd266b22bf5dacde19d279ad64f7f9556bb0a83e94c9b0f77b896e622b3e8f73a1fbc6fcf30b86115d4441be643ae06a0e534989ae4ec0

  • SSDEEP

    49152:EuhOnKu2EUjSBD4f4g3kR4pyFfPjZ9umXLcS4sAmS2NXjiPJEp3RRZSPcFoj5he6:Eiu21t4g3k0yFTZ9u4LZ4mrNXWPJk3zB

Score
8/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      PBCCRCPassGuardEdge.exe

    • Size

      2.7MB

    • MD5

      c0568331b9984599f57d7bbe11e17cd9

    • SHA1

      4860334bc492832586a10f28aaa4c1e9c59ed847

    • SHA256

      57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856

    • SHA512

      cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6

    • SSDEEP

      49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS

    Score
    8/10
    discoveryspywarestealer

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks