Overview

overview

10

Static

static

10

0466159525...c9.exe

windows7-x64

10

0466159525...c9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9

  • Size

    5.4MB

  • Sample

    240614-www7tsvglp

  • MD5

    4fcd5ffc44994df50e06a0889e149b31

  • SHA1

    7561935356870ab77c4a83e728eba8e5804c68f5

  • SHA256

    0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9

  • SHA512

    ca57e591a33c053d4a991ce5549d9d95107cc3651c64ec643d41ba3eb073fef236af46ecd1e09feb4342d5b7be3fba7195bdb0c6aa2bf49763f09e4cb99a1169

  • SSDEEP

    98304:sLrUH+U8GRcZz1a6Fg6DfCOW66hNjyHkmrJv0Ihx7KM:wS+oRlmrFdjKM

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9

    • Size

      5.4MB

    • MD5

      4fcd5ffc44994df50e06a0889e149b31

    • SHA1

      7561935356870ab77c4a83e728eba8e5804c68f5

    • SHA256

      0466159525cb3fab5109b4067f0a429f9880275f7e37aee7b3311fb3356c59c9

    • SHA512

      ca57e591a33c053d4a991ce5549d9d95107cc3651c64ec643d41ba3eb073fef236af46ecd1e09feb4342d5b7be3fba7195bdb0c6aa2bf49763f09e4cb99a1169

    • SSDEEP

      98304:sLrUH+U8GRcZz1a6Fg6DfCOW66hNjyHkmrJv0Ihx7KM:wS+oRlmrFdjKM

    Score
    10/10
    persistencespywarestealer

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Detects executables packed with unregistered version of .NET Reactor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks