Overview

overview

10

Static

static

10

Bo2 menu V2.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Bo2 menu V2.exe

  • Size

    7.3MB

  • Sample

    230929-wpthcseh99

  • MD5

    6ae89e53d47145458f005252067d5796

  • SHA1

    c338aecd4028d86b31f6989d3e4bb79197e589e7

  • SHA256

    d4569ed45e09d8a1557df7a5b8e150056ad7e82e8ddb605f36b3251981d46255

  • SHA512

    fc27aa59f7aa3e62d4b0906356df3deb1b6c41082fc763d62ee3d39777b40203ab5e8dae6e5ea29fbe4061bddb895d3ff504c6c94ef8d612082df03d06f25df6

  • SSDEEP

    196608:lu7YS6GOshoKMuIkhVastRL5Di3uq1D7mu:gYSTOshouIkPftRL54DR3

Score
10/10
blankgrabberevasionspywarestealerupx

Malware Config

Targets

    • Target

      Bo2 menu V2.exe

    • Size

      7.3MB

    • MD5

      6ae89e53d47145458f005252067d5796

    • SHA1

      c338aecd4028d86b31f6989d3e4bb79197e589e7

    • SHA256

      d4569ed45e09d8a1557df7a5b8e150056ad7e82e8ddb605f36b3251981d46255

    • SHA512

      fc27aa59f7aa3e62d4b0906356df3deb1b6c41082fc763d62ee3d39777b40203ab5e8dae6e5ea29fbe4061bddb895d3ff504c6c94ef8d612082df03d06f25df6

    • SSDEEP

      196608:lu7YS6GOshoKMuIkhVastRL5Di3uq1D7mu:gYSTOshouIkPftRL54DR3

    Score
    10/10
    evasionspywarestealerupx

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks