d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb

Sharing

Copy URL Twitter E-mail

General

Target
be174eb4ffb7b227b2e78644b98ef1ab.exe
Size 1.8MB
Sample240308-yd3yrsfd5x
SHA256 d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb
MD5 be174eb4ffb7b227b2e78644b98ef1ab
SHA1 f97edc25319588b1c995beb7133daf037a1cca1a
SHA512 1d03e5ac4ee0caa2abbeda7f11e67d4699b7d35ea488867ffb0809ecc88035c7d53859ba001f02ebc6ad798941a51a31eb27a5c57d8ac4e0ef7552d6a733aeda
SSDEEP 49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  be174eb4ffb7b227b2e78644b98ef1ab.exe
- Size 1.8MB
- SHA256 d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb
- MD5 be174eb4ffb7b227b2e78644b98ef1ab
- SHA1 f97edc25319588b1c995beb7133daf037a1cca1a
- SHA512 1d03e5ac4ee0caa2abbeda7f11e67d4699b7d35ea488867ffb0809ecc88035c7d53859ba001f02ebc6ad798941a51a31eb27a5c57d8ac4e0ef7552d6a733aeda
- SSDEEP 49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery spyware stealer upx
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $TEMP/BroomSetup.exe
- Size 1.7MB
- SHA256 2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
- MD5 eee5ddcffbed16222cac0a1b4e2e466e
- SHA1 28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
- SHA512 8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
- SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  $TEMP/syncUpd.exe
- Size 229KB
- SHA256 748733ef6b3518ec18acbf68a3fa7f43e403738a29a275d6cb2df8e87851c277
- MD5 eda757c6ae24693068781c06550cb3a6
- SHA1 026eff85b267da853dac6cc00866bd1cb1c02c4d
- SHA512 36d171794fa540ecd6112dc1c8f1f393be60af9a1bb8da9e0e64363c390f3c68d370df569738192cfba09361d60e89bac219f0802a5a7c1670c86801c1742060
- SSDEEP 6144:/4qdvcItHrBhjlf6R05be5BlXE0tvi7DDu:BRcItHNCR05Sji0UPu
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

UPX packed file

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

UPX packed file

Downloads MZ/PE file

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8