Overview

overview

10

Static

static

10

AutoDox.exe

windows7-x64

7

AutoDox.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AutoDox.exe

  • Size

    14.5MB

  • Sample

    240510-by7q5aed46

  • MD5

    3c4c29f2d567b20a7a95d64fb362c887

  • SHA1

    e5e0437e756644dfddd7fa240f0453e81ba0ebcf

  • SHA256

    4a057afcc17d079c4687fced9b5bf135b9e3502252846c1bd4d26c4fd8807940

  • SHA512

    02621ce8dc804fedc5a3f0b6494f94fd95c7174e3a82101f2ff1d5476d14432a376c371f325c86f1b8f31d9fd0f6585765c625179edfa0316153c921ae854bd5

  • SSDEEP

    393216:6xfdQuslN/m3pqq9AJ4ZoWOv+9fPV4aHJCI5ctyIk10:6RdQu4KhS4ZorvS3bCI50yIk10

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      AutoDox.exe

    • Size

      14.5MB

    • MD5

      3c4c29f2d567b20a7a95d64fb362c887

    • SHA1

      e5e0437e756644dfddd7fa240f0453e81ba0ebcf

    • SHA256

      4a057afcc17d079c4687fced9b5bf135b9e3502252846c1bd4d26c4fd8807940

    • SHA512

      02621ce8dc804fedc5a3f0b6494f94fd95c7174e3a82101f2ff1d5476d14432a376c371f325c86f1b8f31d9fd0f6585765c625179edfa0316153c921ae854bd5

    • SSDEEP

      393216:6xfdQuslN/m3pqq9AJ4ZoWOv+9fPV4aHJCI5ctyIk10:6RdQu4KhS4ZorvS3bCI50yIk10

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Process Discovery

1
T1057

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks