Overview

overview

8

Static

static

1

_eb91a930-...22.jpg

windows10-1703-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    _eb91a930-dcd6-492b-b58f-f0a4cc1caa22.jpg

  • Size

    138KB

  • Sample

    240428-f4rdjsha38

  • MD5

    3bc05f4b11cfa6920349c5bcbdfa83b5

  • SHA1

    ce43aaa51d3b44eaf52f378e4a4087d6914cb939

  • SHA256

    d37b8af3d6fb807a4a5b2eef5bf1886463855a180284408fbf00365aa5f79787

  • SHA512

    a98be33118f7196f8b7b65d09eac0b64cef411908ecb2de895ff03d60690c4c017331e886f7847e62c4a6d4376f84842684bb9f0c1f46283d89f4b547a2dfd15

  • SSDEEP

    3072:AWHdFmBqmBXGSXvvJ088bkaz2hLNjnAOtopD64JOg:b9FmvBJXvR0AoEJrAKWD64JZ

Score
8/10
persistencespywarestealer

Malware Config

Targets

    • Target

      _eb91a930-dcd6-492b-b58f-f0a4cc1caa22.jpg

    • Size

      138KB

    • MD5

      3bc05f4b11cfa6920349c5bcbdfa83b5

    • SHA1

      ce43aaa51d3b44eaf52f378e4a4087d6914cb939

    • SHA256

      d37b8af3d6fb807a4a5b2eef5bf1886463855a180284408fbf00365aa5f79787

    • SHA512

      a98be33118f7196f8b7b65d09eac0b64cef411908ecb2de895ff03d60690c4c017331e886f7847e62c4a6d4376f84842684bb9f0c1f46283d89f4b547a2dfd15

    • SSDEEP

      3072:AWHdFmBqmBXGSXvvJ088bkaz2hLNjnAOtopD64JOg:b9FmvBJXvR0AoEJrAKWD64JZ

    Score
    8/10
    persistencespywarestealer

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks