Overview

overview

10

Static

static

3

fa396ba6c1...6c.exe

windows7-x64

10

fa396ba6c1...6c.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    2abc28bccfd4512e91ac2b8f3537c307.bin
  • Size 335KB
  • Sample240609-b4csyacd28
  • SHA256 1834324b140e63553adebb89bf2194cfea607d759e2e357859818c6e32e816b6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
collectiondiscoveryevasionspywarestealertrojan

Malware Config

Targets

    • Target
      fa396ba6c1ae4e9c786cff1a78012d86bd9a896f4999d4ba3b90864021fa806c.exe
    • Size 871KB
    • SHA256 fa396ba6c1ae4e9c786cff1a78012d86bd9a896f4999d4ba3b90864021fa806c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    collectiondiscoveryevasionspywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Enumerates VirtualBox registry keys

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks