Overview

overview

10

Static

static

10

eb6f29566b...f1.exe

windows7-x64

9

eb6f29566b...f1.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    eb6f29566b2402ca857c111864372b37837f873be2bef36ab42c62167d3be3f1

  • Size

    303KB

  • Sample

    240311-b49gxahd8z

  • MD5

    d7570b42e772bab440451742a9af2b1c

  • SHA1

    db5307a4c4cbf24e6a16627635b39164f7fcc782

  • SHA256

    eb6f29566b2402ca857c111864372b37837f873be2bef36ab42c62167d3be3f1

  • SHA512

    af56e721a735ef450775b95d14b3d53b7e4752c3f32cad189e016c40e0ea7de4ae7cf49accd6733fcb8edb6e915106f55931e10057bdee6c37d4fa64c96b7d2f

  • SSDEEP

    6144:dXC4vgmhbIxs3NBBl3d7Ev1PMds8m4EJ3sstnI6OwnNxV+rKiTsRun7RURqNxQ:dXCNi9B/gMW8mHcsu6RN/WxT8gjQ

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      eb6f29566b2402ca857c111864372b37837f873be2bef36ab42c62167d3be3f1

    • Size

      303KB

    • MD5

      d7570b42e772bab440451742a9af2b1c

    • SHA1

      db5307a4c4cbf24e6a16627635b39164f7fcc782

    • SHA256

      eb6f29566b2402ca857c111864372b37837f873be2bef36ab42c62167d3be3f1

    • SHA512

      af56e721a735ef450775b95d14b3d53b7e4752c3f32cad189e016c40e0ea7de4ae7cf49accd6733fcb8edb6e915106f55931e10057bdee6c37d4fa64c96b7d2f

    • SSDEEP

      6144:dXC4vgmhbIxs3NBBl3d7Ev1PMds8m4EJ3sstnI6OwnNxV+rKiTsRun7RURqNxQ:dXCNi9B/gMW8mHcsu6RN/WxT8gjQ

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks