Overview

overview

9

Static

static

3

8327f0e5ec...c9.exe

windows7-x64

9

8327f0e5ec...c9.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8327f0e5ecc72e0e3fe07d9e6589c616bb06068c267f67c9f63b9e0ced9133c9

  • Size

    115KB

  • Sample

    240419-3lrmxsbc81

  • MD5

    8d1b0995d6b3466d9d0e367a2f82ffe6

  • SHA1

    2fb684536e8097f43016b23cad34ab1b56632323

  • SHA256

    8327f0e5ecc72e0e3fe07d9e6589c616bb06068c267f67c9f63b9e0ced9133c9

  • SHA512

    ca3ff270fc54fca515f59c9354d076fa643850db98fd1099a0ac74693d503ac7a9c5680132225359c3a77fd1ef4db6ee4d0f7ac31668e1c5468dbd73818a45ae

  • SSDEEP

    1536:aJUGCqveEeXdTeG4wu6oQuwEhQQWKXJR721rSTdk/cpAKdlaKrorkgA55i:aHFveEyTAK7VKXXS1GT7AKzaKrtP55i

Score
9/10
aspackv2bootkitpersistencespywarestealer

Malware Config

Targets

    • Target

      8327f0e5ecc72e0e3fe07d9e6589c616bb06068c267f67c9f63b9e0ced9133c9

    • Size

      115KB

    • MD5

      8d1b0995d6b3466d9d0e367a2f82ffe6

    • SHA1

      2fb684536e8097f43016b23cad34ab1b56632323

    • SHA256

      8327f0e5ecc72e0e3fe07d9e6589c616bb06068c267f67c9f63b9e0ced9133c9

    • SHA512

      ca3ff270fc54fca515f59c9354d076fa643850db98fd1099a0ac74693d503ac7a9c5680132225359c3a77fd1ef4db6ee4d0f7ac31668e1c5468dbd73818a45ae

    • SSDEEP

      1536:aJUGCqveEeXdTeG4wu6oQuwEhQQWKXJR721rSTdk/cpAKdlaKrorkgA55i:aHFveEyTAK7VKXXS1GT7AKzaKrtP55i

    Score
    9/10
    aspackv2bootkitpersistencespywarestealer

    • Detects executables containing base64 encoded User Agent

    • Blocklisted process makes network request

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks