Overview

overview

10

Static

static

10

910c56a4b4...d4.exe

windows7-x64

9

910c56a4b4...d4.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    910c56a4b49621551658451f63ebdb0abbca2c5ef7a75cbac0af4bde254244d4

  • Size

    2.0MB

  • Sample

    240411-atbbpafd68

  • MD5

    e142209b8ea8465bcac280c85636eae7

  • SHA1

    a5b75adf91d1f1bca071c4c82e1e6524d0b304df

  • SHA256

    910c56a4b49621551658451f63ebdb0abbca2c5ef7a75cbac0af4bde254244d4

  • SHA512

    0e15ce759a92c58d4deb570b82467dd2d25a7a57059bdce322481354511522fc17d6e1e234f8a70d9949bfb8b936e8c105e11cd52904f20be12e5f56ffb054b3

  • SSDEEP

    49152:rjy5tYyk2jJyA78O7sH9L8OmQGb0TX/ui3WyrH+c8NtoU7Enk:Y9k2jUY8O7qFjmpbMXGiB+c8TrQk

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      910c56a4b49621551658451f63ebdb0abbca2c5ef7a75cbac0af4bde254244d4

    • Size

      2.0MB

    • MD5

      e142209b8ea8465bcac280c85636eae7

    • SHA1

      a5b75adf91d1f1bca071c4c82e1e6524d0b304df

    • SHA256

      910c56a4b49621551658451f63ebdb0abbca2c5ef7a75cbac0af4bde254244d4

    • SHA512

      0e15ce759a92c58d4deb570b82467dd2d25a7a57059bdce322481354511522fc17d6e1e234f8a70d9949bfb8b936e8c105e11cd52904f20be12e5f56ffb054b3

    • SSDEEP

      49152:rjy5tYyk2jJyA78O7sH9L8OmQGb0TX/ui3WyrH+c8NtoU7Enk:Y9k2jUY8O7qFjmpbMXGiB+c8TrQk

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks