Overview

overview

10

Static

static

10

913ad33937...42.exe

windows7-x64

9

913ad33937...42.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42

  • Size

    471KB

  • Sample

    240616-3xrgasycqq

  • MD5

    d973614d4cac301358263701ff674963

  • SHA1

    9126bdac6de090d1f4d9c1cde85daa933345eb45

  • SHA256

    913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42

  • SHA512

    4129b75063ca45c6f8c4153c6ca92f556dfd3d860510b63aa80a3704b9d97e4aaa5b118eca1a24f03126848ec7fd713af0a81183cd348ac8e6fc3f951a0e21b8

  • SSDEEP

    12288:JXCNi9BVcvXy6sPPyo45dZqNwlG7MEYTUso9nWp489+:sWCvkPPyX58w6M6sQnWp489+

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42

    • Size

      471KB

    • MD5

      d973614d4cac301358263701ff674963

    • SHA1

      9126bdac6de090d1f4d9c1cde85daa933345eb45

    • SHA256

      913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42

    • SHA512

      4129b75063ca45c6f8c4153c6ca92f556dfd3d860510b63aa80a3704b9d97e4aaa5b118eca1a24f03126848ec7fd713af0a81183cd348ac8e6fc3f951a0e21b8

    • SSDEEP

      12288:JXCNi9BVcvXy6sPPyo45dZqNwlG7MEYTUso9nWp489+:sWCvkPPyX58w6M6sQnWp489+

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks