Overview

overview

8

Static

static

3

ExInject V4.exe

windows7-x64

7

ExInject V4.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ExInject V4.exe

  • Size

    40.4MB

  • Sample

    240509-q5kx9sff57

  • MD5

    b5376b0ac908c1ff23f00ba4b4823f87

  • SHA1

    89f270e1404a76594b0780d70a7ab9491b1e0de3

  • SHA256

    6957aa3b521d1ddcc4a512e2fe7aa93eabf58e9a53a4acd4866c4930a881de28

  • SHA512

    49c1704611beec9469cb47c74fa285404afe33b442a2aa64dd0a4efdb5bc2cf523096d1fca9044f81d7e9ea8488f7ee8b9f3b7d015aee1bec4167bf69d555d40

  • SSDEEP

    393216:zWvz+q3V1VUIC3L+9qz8GvD7fEU2IGY/Vt1Wom6:Sz+q37/O+9q4GL7fEvILpm6

Score
8/10
executionpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      ExInject V4.exe

    • Size

      40.4MB

    • MD5

      b5376b0ac908c1ff23f00ba4b4823f87

    • SHA1

      89f270e1404a76594b0780d70a7ab9491b1e0de3

    • SHA256

      6957aa3b521d1ddcc4a512e2fe7aa93eabf58e9a53a4acd4866c4930a881de28

    • SHA512

      49c1704611beec9469cb47c74fa285404afe33b442a2aa64dd0a4efdb5bc2cf523096d1fca9044f81d7e9ea8488f7ee8b9f3b7d015aee1bec4167bf69d555d40

    • SSDEEP

      393216:zWvz+q3V1VUIC3L+9qz8GvD7fEU2IGY/Vt1Wom6:Sz+q37/O+9q4GL7fEvILpm6

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks