Overview

overview

8

Static

static

3

1b72146650...7f.exe

windows7-x64

8

1b72146650...7f.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1b721466504b3254ddd77a63707d857f

  • Size

    500KB

  • Sample

    231225-nsbgysecgj

  • MD5

    1b721466504b3254ddd77a63707d857f

  • SHA1

    17139c7d7d917a70e8d0bbb53329db8975bae4e5

  • SHA256

    49f9b4cb0955037e537cec4eacba3c12874b19ff426a3de2e0bb128eecf50097

  • SHA512

    3dd190044218ce1304cfe8b538bc80a2f3cc916082c4ff0fe8c542283fb48f5deb2c9cc287b1f51d9d8eb7003c5564af5f33c0712a035636b6cfc6e5c1304ab2

  • SSDEEP

    12288:9tztVdB3lyQ3+i+ki3akd1I2ZX/rzUI0vpqf48cAiGIfs6gJ53yjDK:9N3lB323962ZkIQqfPz6myjm

Score
8/10
adwarebootkitpersistencestealer

Malware Config

Targets

    • Target

      1b721466504b3254ddd77a63707d857f

    • Size

      500KB

    • MD5

      1b721466504b3254ddd77a63707d857f

    • SHA1

      17139c7d7d917a70e8d0bbb53329db8975bae4e5

    • SHA256

      49f9b4cb0955037e537cec4eacba3c12874b19ff426a3de2e0bb128eecf50097

    • SHA512

      3dd190044218ce1304cfe8b538bc80a2f3cc916082c4ff0fe8c542283fb48f5deb2c9cc287b1f51d9d8eb7003c5564af5f33c0712a035636b6cfc6e5c1304ab2

    • SSDEEP

      12288:9tztVdB3lyQ3+i+ki3akd1I2ZX/rzUI0vpqf48cAiGIfs6gJ53yjDK:9N3lB323962ZkIQqfPz6myjm

    Score
    8/10
    adwarebootkitpersistencestealer

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks