Overview

overview

10

Static

static

10

MethodReveal.exe

windows7-x64

7

MethodReveal.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MethodReveal.exe

  • Size

    7.7MB

  • Sample

    240603-lx5v9abh86

  • MD5

    f0fdcba521fda1be3007670423954249

  • SHA1

    d42ae34e8d15a5759b1444d37d3eac510a0cde4d

  • SHA256

    6bd45a7022878713fc90229c9670a0de5d3fb1addc623acab8f57b94e3fe16ad

  • SHA512

    78e4400c9b0cde9f0415a4f6018a781586381b55b5650842d7754309f4ec7132a0bcc002c7bda7b4cae4f688a04d0441b12253957e840af2f2774e117100cbfc

  • SSDEEP

    98304:iRgzHqdVfB2T0S27wYpFyuT/9vUIdD9C+z3zO917vOTh+ezDNhCSpXq4JvmJ1nm8:i2QsTqpFbT/9bvLz3S1bA3zCSEpn97YI

Score
10/10
blankgrabberexecutionspywarestealerupx

Malware Config

Targets

    • Target

      MethodReveal.exe

    • Size

      7.7MB

    • MD5

      f0fdcba521fda1be3007670423954249

    • SHA1

      d42ae34e8d15a5759b1444d37d3eac510a0cde4d

    • SHA256

      6bd45a7022878713fc90229c9670a0de5d3fb1addc623acab8f57b94e3fe16ad

    • SHA512

      78e4400c9b0cde9f0415a4f6018a781586381b55b5650842d7754309f4ec7132a0bcc002c7bda7b4cae4f688a04d0441b12253957e840af2f2774e117100cbfc

    • SSDEEP

      98304:iRgzHqdVfB2T0S27wYpFyuT/9vUIdD9C+z3zO917vOTh+ezDNhCSpXq4JvmJ1nm8:i2QsTqpFbT/9bvLz3S1bA3zCSEpn97YI

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks