Overview

overview

10

Static

static

10

e5f0e1dcaa...e5.exe

windows7-x64

9

e5f0e1dcaa...e5.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    e5f0e1dcaadf350f52f9bd4492c7ffd1b1c3ee35efea0d8cced2c6c445ddd7e5

  • Size

    411KB

  • Sample

    240409-3zfskseb3w

  • MD5

    60bff99aa4b3d1fe4b7dc4be975c59ae

  • SHA1

    fed5528bd0bb55dc036510da81412513b0964e58

  • SHA256

    e5f0e1dcaadf350f52f9bd4492c7ffd1b1c3ee35efea0d8cced2c6c445ddd7e5

  • SHA512

    f81de06470120573ee233d3a494da1650c87a252139988fc972f6632821a6ce751d0f50fd0f85612cf48b4da929e013886deda3e11ca36c4cfc1f186903e4cf8

  • SSDEEP

    6144:9rTfUHeeSKOS9ccFKk3Y9t9Y/wVjFEvxje3abGNpXXf:9n8yN0Mr8/wVjFEvxKKiNpnf

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      e5f0e1dcaadf350f52f9bd4492c7ffd1b1c3ee35efea0d8cced2c6c445ddd7e5

    • Size

      411KB

    • MD5

      60bff99aa4b3d1fe4b7dc4be975c59ae

    • SHA1

      fed5528bd0bb55dc036510da81412513b0964e58

    • SHA256

      e5f0e1dcaadf350f52f9bd4492c7ffd1b1c3ee35efea0d8cced2c6c445ddd7e5

    • SHA512

      f81de06470120573ee233d3a494da1650c87a252139988fc972f6632821a6ce751d0f50fd0f85612cf48b4da929e013886deda3e11ca36c4cfc1f186903e4cf8

    • SSDEEP

      6144:9rTfUHeeSKOS9ccFKk3Y9t9Y/wVjFEvxje3abGNpXXf:9n8yN0Mr8/wVjFEvxKKiNpnf

    Score
    9/10
    persistencespywarestealer

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks