Overview

overview

10

Static

static

10

611ec153c4...00.exe

windows7-x64

9

611ec153c4...00.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    611ec153c42610b3a25be04122b8c9ef1e660c93dddf8ddd3ad6e425432cb900

  • Size

    361KB

  • Sample

    240421-19l18scd2y

  • MD5

    38c7735fb872cc5d4bade889f644688c

  • SHA1

    93d9f99859e416e0f57873b301a0eb34e26840c5

  • SHA256

    611ec153c42610b3a25be04122b8c9ef1e660c93dddf8ddd3ad6e425432cb900

  • SHA512

    e673afdfdb18ae0f559c1e6e00c37e4119a9ef89edcc4eaf43c141411765b148836e1d2c1f50d893aa526ebad1e920527bdefff0dcdc272776efaee1c8a1cfad

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZpSRZJYmJuAEaHFW2wt5f1r2:/n8yN0Mr8ZpSRZJDo9kFW2wt5f1r2

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      611ec153c42610b3a25be04122b8c9ef1e660c93dddf8ddd3ad6e425432cb900

    • Size

      361KB

    • MD5

      38c7735fb872cc5d4bade889f644688c

    • SHA1

      93d9f99859e416e0f57873b301a0eb34e26840c5

    • SHA256

      611ec153c42610b3a25be04122b8c9ef1e660c93dddf8ddd3ad6e425432cb900

    • SHA512

      e673afdfdb18ae0f559c1e6e00c37e4119a9ef89edcc4eaf43c141411765b148836e1d2c1f50d893aa526ebad1e920527bdefff0dcdc272776efaee1c8a1cfad

    • SSDEEP

      6144:/rTfUHeeSKOS9ccFKk3Y9t9YZpSRZJYmJuAEaHFW2wt5f1r2:/n8yN0Mr8ZpSRZJDo9kFW2wt5f1r2

    Score
    9/10
    persistencespywarestealer

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks