Overview

overview

10

Static

static

10

81740342d6...3f.exe

windows7-x64

10

81740342d6...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81740342d64bc105d369f39bcf23e93f.exe

  • Size

    149KB

  • Sample

    240614-rad2xatcnf

  • MD5

    81740342d64bc105d369f39bcf23e93f

  • SHA1

    4d5d266bc24ed969108c68f794883957a22ae939

  • SHA256

    600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8

  • SHA512

    3be9e90c67ef641b94f81c86344082b63c690e906a1fed7825bb6a0321cd4c8289d8e64e9583897ce832cad137f475e66053ace4d43f2b6a741d33b3709ead91

  • SSDEEP

    3072:HemwkmgMXfbtdBE2a/duEx5cLbfu3/XcW5DC2kgZ8YfHcvOgbg8vW/f:HfmgMXfbtdK2a/dh5cLeC2kgZ8YfHcv/

Score
10/10
xehookspywarestealer

Malware Config

Targets

    • Target

      81740342d64bc105d369f39bcf23e93f.exe

    • Size

      149KB

    • MD5

      81740342d64bc105d369f39bcf23e93f

    • SHA1

      4d5d266bc24ed969108c68f794883957a22ae939

    • SHA256

      600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8

    • SHA512

      3be9e90c67ef641b94f81c86344082b63c690e906a1fed7825bb6a0321cd4c8289d8e64e9583897ce832cad137f475e66053ace4d43f2b6a741d33b3709ead91

    • SSDEEP

      3072:HemwkmgMXfbtdBE2a/duEx5cLbfu3/XcW5DC2kgZ8YfHcvOgbg8vW/f:HfmgMXfbtdK2a/dh5cLeC2kgZ8YfHcv/

    Score
    10/10
    xehookspywarestealer

    • Detect Xehook Payload

    • Xehook stealer

      Xehook is an infostealer written in C#.

      stealerxehook

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks