Overview

overview

10

Static

static

10

34e10600cc...f7.exe

windows7-x64

9

34e10600cc...f7.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    34e10600ccd4e50d54b463b966c21a248ea9e63ac7a6404918a824e58f5eeaf7

  • Size

    1.2MB

  • Sample

    240305-xzdekaeg6t

  • MD5

    40a022d28d08405d09e0a0018144ac21

  • SHA1

    9b77edd664d5ed369eaf6c8705f605a476eba0e5

  • SHA256

    34e10600ccd4e50d54b463b966c21a248ea9e63ac7a6404918a824e58f5eeaf7

  • SHA512

    e6fbcda9f4dfacc8967b17aa7cc92d18fa33c64e812a693cdf72ae7f66e1624aff295e08a7517b4ea30e3f8181da5457fdcbbc15f22a6256f67da5b5ad8329b9

  • SSDEEP

    24576:86UWpVvX31nt9Xby5uB/GKnzT6Xb7/2gPIjENYmuY+N:5nbP31nt9XbWuB/GAufOr0j+N

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      34e10600ccd4e50d54b463b966c21a248ea9e63ac7a6404918a824e58f5eeaf7

    • Size

      1.2MB

    • MD5

      40a022d28d08405d09e0a0018144ac21

    • SHA1

      9b77edd664d5ed369eaf6c8705f605a476eba0e5

    • SHA256

      34e10600ccd4e50d54b463b966c21a248ea9e63ac7a6404918a824e58f5eeaf7

    • SHA512

      e6fbcda9f4dfacc8967b17aa7cc92d18fa33c64e812a693cdf72ae7f66e1624aff295e08a7517b4ea30e3f8181da5457fdcbbc15f22a6256f67da5b5ad8329b9

    • SSDEEP

      24576:86UWpVvX31nt9Xby5uB/GKnzT6Xb7/2gPIjENYmuY+N:5nbP31nt9XbWuB/GAufOr0j+N

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks