Overview

overview

10

Static

static

10

a1a204279d...a5.exe

windows7-x64

7

a1a204279d...a5.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1a204279d3cdcf73ce14a62268795170aece0aa178c9f18c489d83530b14da5

  • Size

    158.0MB

  • Sample

    231203-c62erahc3x

  • MD5

    cc2c8d512857a17adb73a8766a8c6919

  • SHA1

    e5ee90693b92785f14bb6063f92f46b9bff561f0

  • SHA256

    a1a204279d3cdcf73ce14a62268795170aece0aa178c9f18c489d83530b14da5

  • SHA512

    2b9a2280e813a929866588374178e9f9fed48f337b5c97719a6391192f55f1db61d94136916fed8eb8be1c46345d5ef4bb4df078131d5b0aec862a4dade364dc

  • SSDEEP

    1572864:IWaH/Eoq13lOsygFXvraqpQwvKeh0ew1988ae7XRuiRU2A:nxlDZF/raqpQwiyiR8

Score
10/10
ducktailpersistencespywarestealer

Malware Config

Targets

    • Target

      a1a204279d3cdcf73ce14a62268795170aece0aa178c9f18c489d83530b14da5

    • Size

      158.0MB

    • MD5

      cc2c8d512857a17adb73a8766a8c6919

    • SHA1

      e5ee90693b92785f14bb6063f92f46b9bff561f0

    • SHA256

      a1a204279d3cdcf73ce14a62268795170aece0aa178c9f18c489d83530b14da5

    • SHA512

      2b9a2280e813a929866588374178e9f9fed48f337b5c97719a6391192f55f1db61d94136916fed8eb8be1c46345d5ef4bb4df078131d5b0aec862a4dade364dc

    • SSDEEP

      1572864:IWaH/Eoq13lOsygFXvraqpQwvKeh0ew1988ae7XRuiRU2A:nxlDZF/raqpQwiyiR8

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks