Overview

overview

10

Static

static

10

RO-exec.exe

windows7-x64

7

RO-exec.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RO-exec.exe

  • Size

    16.1MB

  • Sample

    240522-y55axafc97

  • MD5

    bb87d0428bcf45096361905394d54ea6

  • SHA1

    3f6af9965392527f1114ceefa310a358bdd4e891

  • SHA256

    4ee96641b42756834975a2cd7940ff3d36132289e9f5d37867d6d1fe2ef6cef1

  • SHA512

    4790c538a68b8a4d93e869e624d8aed3017d0e58ee19e760df4e8dd845d119821c7c9f4663e05ebd270cd669ad297c79c8996112564faf6230b9470bcf054778

  • SSDEEP

    393216:VrHDJoShonfH28IcSvucRuHKL+9qz8LD7fEUbiI6NQcH:djJhaH2TvL+9q4v7fEbI6zH

Score
10/10
blankgrabberexecutionspywarestealerupx

Malware Config

Targets

    • Target

      RO-exec.exe

    • Size

      16.1MB

    • MD5

      bb87d0428bcf45096361905394d54ea6

    • SHA1

      3f6af9965392527f1114ceefa310a358bdd4e891

    • SHA256

      4ee96641b42756834975a2cd7940ff3d36132289e9f5d37867d6d1fe2ef6cef1

    • SHA512

      4790c538a68b8a4d93e869e624d8aed3017d0e58ee19e760df4e8dd845d119821c7c9f4663e05ebd270cd669ad297c79c8996112564faf6230b9470bcf054778

    • SSDEEP

      393216:VrHDJoShonfH28IcSvucRuHKL+9qz8LD7fEUbiI6NQcH:djJhaH2TvL+9q4v7fEbI6zH

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks