Overview

overview

10

Static

static

3

f57fc5d78b...ex.exe

windows7-x64

10

f57fc5d78b...ex.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f57fc5d78bdfecexeexeexeex.exe

  • Size

    2.1MB

  • Sample

    230711-qb52caac3s

  • MD5

    f57fc5d78bdfec47b1c1dbb2f40fd0f3

  • SHA1

    01991a8109235758341d947c985365b30bd4d970

  • SHA256

    647bd6c895d96b71439ad2530ae149900390f2b60feefbdeae2e1df8f17afae4

  • SHA512

    0864e7a631868648f9151f169eb5a164c8c2f26a2ddfba5e11a39f7f2ceac1d8c7c171d19cb7f8bc33addcf70d86aeb7c2aab83c56012a8691ce7e76172eca8b

  • SSDEEP

    24576:TFhOpTH0SmBBs7SuRxUf3JH5/bps3wRx68k124TrjBVoRFX2EjaBsHAA/ZFmDC5I:hETUScGSn/brxl4wfz70lEudnP1

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      f57fc5d78bdfecexeexeexeex.exe

    • Size

      2.1MB

    • MD5

      f57fc5d78bdfec47b1c1dbb2f40fd0f3

    • SHA1

      01991a8109235758341d947c985365b30bd4d970

    • SHA256

      647bd6c895d96b71439ad2530ae149900390f2b60feefbdeae2e1df8f17afae4

    • SHA512

      0864e7a631868648f9151f169eb5a164c8c2f26a2ddfba5e11a39f7f2ceac1d8c7c171d19cb7f8bc33addcf70d86aeb7c2aab83c56012a8691ce7e76172eca8b

    • SSDEEP

      24576:TFhOpTH0SmBBs7SuRxUf3JH5/bps3wRx68k124TrjBVoRFX2EjaBsHAA/ZFmDC5I:hETUScGSn/brxl4wfz70lEudnP1

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks