Overview

overview

10

Static

static

10

f6b8de6e18...be.exe

windows7-x64

9

f6b8de6e18...be.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    f6b8de6e18a336c7e006fe3f7c8a28f5af8aeab3458d695de142281aa5f486be

  • Size

    1.6MB

  • Sample

    240422-fvryqaga97

  • MD5

    29fe1fcb03deeacb181b93fbb688ef8b

  • SHA1

    fa01e3199d186c6fd0274cd91e85300edb904f65

  • SHA256

    f6b8de6e18a336c7e006fe3f7c8a28f5af8aeab3458d695de142281aa5f486be

  • SHA512

    e1b370af113e3a7b6ecaec1874af437e9fd9c4cf47c3ac7b37f594e2cce6ef6fed70efa6844b3fb69215b28675e7e3e135cbef6ad04cb4e557f188f0009e564a

  • SSDEEP

    24576:lq8TT1u35s48RJ0HCcm+RTxmzicwzMwsZO0aAX1TH+6Uy3EzI9quPPkFjZBzB5wy:nm0/0Zoidz5sDaAZFE5uP8FjZvyT75Q

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      f6b8de6e18a336c7e006fe3f7c8a28f5af8aeab3458d695de142281aa5f486be

    • Size

      1.6MB

    • MD5

      29fe1fcb03deeacb181b93fbb688ef8b

    • SHA1

      fa01e3199d186c6fd0274cd91e85300edb904f65

    • SHA256

      f6b8de6e18a336c7e006fe3f7c8a28f5af8aeab3458d695de142281aa5f486be

    • SHA512

      e1b370af113e3a7b6ecaec1874af437e9fd9c4cf47c3ac7b37f594e2cce6ef6fed70efa6844b3fb69215b28675e7e3e135cbef6ad04cb4e557f188f0009e564a

    • SSDEEP

      24576:lq8TT1u35s48RJ0HCcm+RTxmzicwzMwsZO0aAX1TH+6Uy3EzI9quPPkFjZBzB5wy:nm0/0Zoidz5sDaAZFE5uP8FjZvyT75Q

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks