Overview

overview

9

Static

static

3

795cc44db0...90.exe

windows7-x64

9

795cc44db0...90.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    795cc44db083221b07332f10d2cdca7717850b814a772beadd0b86317084bd90

  • Size

    270KB

  • Sample

    240308-y6mggsgc6v

  • MD5

    0bc5646d6e991958c0a08f6e97c02365

  • SHA1

    21084ec21e477d0102c999621ce17bf33961af8a

  • SHA256

    795cc44db083221b07332f10d2cdca7717850b814a772beadd0b86317084bd90

  • SHA512

    b704dd41539d4b3f7ac4413d0f9f78ff3934ed312fdd04c84685da6c20fe66bc70ebd5cdae2de1b8c3d4b7b97a20e7f93ecd0165f0a07a62d23e1b765a315456

  • SSDEEP

    6144:4Tr36rMH59clu/5f8tqvA+70c2r3rBlL:4yrMHLcQPAG0c2T7

Score
9/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      795cc44db083221b07332f10d2cdca7717850b814a772beadd0b86317084bd90

    • Size

      270KB

    • MD5

      0bc5646d6e991958c0a08f6e97c02365

    • SHA1

      21084ec21e477d0102c999621ce17bf33961af8a

    • SHA256

      795cc44db083221b07332f10d2cdca7717850b814a772beadd0b86317084bd90

    • SHA512

      b704dd41539d4b3f7ac4413d0f9f78ff3934ed312fdd04c84685da6c20fe66bc70ebd5cdae2de1b8c3d4b7b97a20e7f93ecd0165f0a07a62d23e1b765a315456

    • SSDEEP

      6144:4Tr36rMH59clu/5f8tqvA+70c2r3rBlL:4yrMHLcQPAG0c2T7

    Score
    9/10
    discoveryspywarestealer

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks