Overview

overview

10

Static

static

10

6dab794279...ef.exe

windows7-x64

1

6dab794279...ef.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7afdfc51e20e5f336761b4a1964a8949428dff7b96ea8389c4db9383afe2e336

  • Size

    19.0MB

  • Sample

    240511-jjncyaeb2x

  • MD5

    0104cdb3dd51da98fbd24951affc828c

  • SHA1

    4612f04e0b8ddcf4fc033918f64aaff1bbcb99c3

  • SHA256

    7afdfc51e20e5f336761b4a1964a8949428dff7b96ea8389c4db9383afe2e336

  • SHA512

    6fd232526c8e2c5dc2424fc0c133124bd5805c9134a97dfa3eefde4746380cd353fba40057b7c0ca7648fcbb452d61c3ce83ede906689d663ba8c67f566d8b93

  • SSDEEP

    393216:RItyI2+YArBgSdWSLG7WDrLgx9AEskNs+VULrIme4PKd72Qg3kGGKwpV:Mw+xtgSk8G7Iw/BsGaLrne4O72L3Fdwj

Score
10/10
privateloaderexecutionpersistencespywarestealer

Malware Config

Targets

    • Target

      6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef.exe

    • Size

      37.6MB

    • MD5

      dbcc5cfb5b91fae4370930affd3d7ef9

    • SHA1

      5e5598375c5abeee8c18c9c28a5138e3763df29b

    • SHA256

      6dab794279dc9e6d92d967740790aa5b3e159a7913cd81b0cf424bdb9f0ac2ef

    • SHA512

      0b66dbb037c5e30a451732403d5e0f278588bf78d4c12d660b75f53713f05e233bb5785942155f5dab88ecb92edc789c8b583621077077f7bee1b56f20dc8584

    • SSDEEP

      393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg196l+ZArYsFRlQ6x:R3on1HvSzxAMN1FZArYsDPv47OZRqIx

    Score
    8/10
    executionpersistencespywarestealer

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks