Overview

overview

8

Static

static

3

6564a8e469...49.exe

windows7-x64

8

6564a8e469...49.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    6564a8e46904c57de5c41c4a9620dc49

  • Size

    736KB

  • Sample

    240118-pwybkacdc9

  • MD5

    6564a8e46904c57de5c41c4a9620dc49

  • SHA1

    930c7f08ca19119361269c3fb330b91b1ac18ada

  • SHA256

    23a10b28be23c6b82e0f2ae3a7187422753e5a765e18359944d80091cefc6175

  • SHA512

    3903c721eb0f813a1e82ebf231557f9feef60bb47567e972518a91f587881bcafeeb8e3d87a05329b97363d6f36431f9cabd139870bd01ccb539e69f1eca0971

  • SSDEEP

    12288:D5OrQ+3I3bcbLCO3uFCkB7aGalDaEYlsp9YBUqruXYmb0HPddusC1h:DI8LLQCauhB7AI5u9YB1uXLCddusCr

Score
8/10
adwareevasionpersistencestealerupx

Malware Config

Targets

    • Target

      6564a8e46904c57de5c41c4a9620dc49

    • Size

      736KB

    • MD5

      6564a8e46904c57de5c41c4a9620dc49

    • SHA1

      930c7f08ca19119361269c3fb330b91b1ac18ada

    • SHA256

      23a10b28be23c6b82e0f2ae3a7187422753e5a765e18359944d80091cefc6175

    • SHA512

      3903c721eb0f813a1e82ebf231557f9feef60bb47567e972518a91f587881bcafeeb8e3d87a05329b97363d6f36431f9cabd139870bd01ccb539e69f1eca0971

    • SSDEEP

      12288:D5OrQ+3I3bcbLCO3uFCkB7aGalDaEYlsp9YBUqruXYmb0HPddusC1h:DI8LLQCauhB7AI5u9YB1uXLCddusCr

    Score
    8/10
    adwareevasionpersistencestealerupx

    • Adds policy Run key to start application

      persistence

    • Drops file in Drivers directory

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks