Overview

overview

7

Static

static

1

f_001bb5.exe

windows7-x64

7

f_001bb5.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    f_001bb5.zip

  • Size

    466KB

  • Sample

    230901-jelnjsdc9y

  • MD5

    971605781586dc9fe1601526f7193eb3

  • SHA1

    f5f5c5c7d362981edbf9073e1d8f23480363b529

  • SHA256

    387eb0376b271b04c42dc30d55cd8a6372a7e23262cd7e644d52022728268266

  • SHA512

    52499987f358dc322268779e944ef0c608ace1cfd5af94f40d22d24d7ccf09bf9f6f89517bef071e05f48fd3d5031e4dd25d41c4e6a3ad4a371009fd4d306edb

  • SSDEEP

    12288:MEryOe8X5hHtm2DFQVnPWuIyM7gksmDxw:dyU5FQ20I7TsmW

Score
7/10
discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      f_001bb5

    • Size

      553KB

    • MD5

      dba5bb17815b7180a38c938c72aeaf6c

    • SHA1

      78deaa833e0d9fe00448f810a1928e34d4e09316

    • SHA256

      77aecf89fec1ca8aedac356cfed0887e365e2caf8555bd964c061720137cf2cb

    • SHA512

      82862737d69bf0cbdf9efdab319eddbc09ba6d22ac46b1afd1395603e58f5f8f2b6c33ab9912241ccb4d39c866a59426f13a7714af7dbc33018f0c3258ba4de1

    • SSDEEP

      12288:rG5knZfFKeXjbTUoaws89d99m7pSRGzDP5SAkmD:rG50ZfFKgLL9m7e2jU2D

    Score
    7/10
    discoverypersistencespywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks