Overview

overview

10

Static

static

10

706cb4bb64...93.exe

windows7-x64

9

706cb4bb64...93.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93

  • Size

    479KB

  • Sample

    240428-2d43lsag48

  • MD5

    6807f2e692f91e23e09af0ba65001ea7

  • SHA1

    ed68648edfa4e2349ae845670a2ad70d47c494a8

  • SHA256

    706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93

  • SHA512

    b3009c79bde49c080813b5006dfbde7e63c893eba0bcc745c2ce2a19981305dc36f7a82c3fee2c17bf12e5d1ed003f4a46c74ca4945a10393d77348e3e8b06e3

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZGXPwwWJvcvp7lszsmAgFV:/n8yN0Mr8Z1JJqp7lsAcFV

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93

    • Size

      479KB

    • MD5

      6807f2e692f91e23e09af0ba65001ea7

    • SHA1

      ed68648edfa4e2349ae845670a2ad70d47c494a8

    • SHA256

      706cb4bb64aeec95039396bfd24354a47b70a76ea35c28605f809753768b6f93

    • SHA512

      b3009c79bde49c080813b5006dfbde7e63c893eba0bcc745c2ce2a19981305dc36f7a82c3fee2c17bf12e5d1ed003f4a46c74ca4945a10393d77348e3e8b06e3

    • SSDEEP

      6144:/rTfUHeeSKOS9ccFKk3Y9t9YZGXPwwWJvcvp7lszsmAgFV:/n8yN0Mr8Z1JJqp7lsAcFV

    Score
    9/10
    persistencespywarestealer

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks