Overview

overview

10

Static

static

10

169ba5f18f...eb.exe

windows7-x64

9

169ba5f18f...eb.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    169ba5f18f676b43fb1c0963e740bdefee5a50dfce6a2a226604793043aa5aeb

  • Size

    402KB

  • Sample

    240419-xpcqaade7v

  • MD5

    68389cdd6a6d32618183a9d064c7fb87

  • SHA1

    d78e9d9771ff46a0ee5f0a891597f3a2643e65a2

  • SHA256

    169ba5f18f676b43fb1c0963e740bdefee5a50dfce6a2a226604793043aa5aeb

  • SHA512

    ff8977f12bae7a938c6f94955c069fe2cfc135d96e604206aeb03e7be1857676375213387af28367871888728223b588ae58a1297d08560c7ef86091ada8498b

  • SSDEEP

    6144:9rTfUHeeSKOS9ccFKk3Y9t9Yl5736ezMLnbJW5:9n8yN0Mr8f3N0nbJW5

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      169ba5f18f676b43fb1c0963e740bdefee5a50dfce6a2a226604793043aa5aeb

    • Size

      402KB

    • MD5

      68389cdd6a6d32618183a9d064c7fb87

    • SHA1

      d78e9d9771ff46a0ee5f0a891597f3a2643e65a2

    • SHA256

      169ba5f18f676b43fb1c0963e740bdefee5a50dfce6a2a226604793043aa5aeb

    • SHA512

      ff8977f12bae7a938c6f94955c069fe2cfc135d96e604206aeb03e7be1857676375213387af28367871888728223b588ae58a1297d08560c7ef86091ada8498b

    • SSDEEP

      6144:9rTfUHeeSKOS9ccFKk3Y9t9Yl5736ezMLnbJW5:9n8yN0Mr8f3N0nbJW5

    Score
    9/10
    persistencespywarestealer

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks