Overview

overview

8

Static

static

1

Ro-Booster-FPS.exe

windows7-x64

7

Ro-Booster-FPS.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Ro-Booster-FPS.exe

  • Size

    63.0MB

  • Sample

    240624-vmpwqatbkc

  • MD5

    c027816176fcb54b8b0ba7a6297bbc17

  • SHA1

    e9f7fa474ccb1ca21fabf6b18a230a7c74998474

  • SHA256

    7c30f4b73e8774145f4a49c6df6bce9db0d8ad03fd905e637ef5e910ff335553

  • SHA512

    a67958e698a76bdc64d1d30f67e33e25440461df2343e6342859534e0d9765399a3af3e830043c3d19bb955e454408e3097b85854c5f7143680218cd7b2d5915

  • SSDEEP

    786432:6p9/QwO7QqMoknvNpA+vIlo0FdGgrHxbjByTvnKvIjjk3ESWqEp+0/pWTPuxBNxx:U/Qw0QqMrlpA+Ql4WjDvIswqrS5nNxGY

Score
8/10
defense_evasionexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      Ro-Booster-FPS.exe

    • Size

      63.0MB

    • MD5

      c027816176fcb54b8b0ba7a6297bbc17

    • SHA1

      e9f7fa474ccb1ca21fabf6b18a230a7c74998474

    • SHA256

      7c30f4b73e8774145f4a49c6df6bce9db0d8ad03fd905e637ef5e910ff335553

    • SHA512

      a67958e698a76bdc64d1d30f67e33e25440461df2343e6342859534e0d9765399a3af3e830043c3d19bb955e454408e3097b85854c5f7143680218cd7b2d5915

    • SSDEEP

      786432:6p9/QwO7QqMoknvNpA+vIlo0FdGgrHxbjByTvnKvIjjk3ESWqEp+0/pWTPuxBNxx:U/Qw0QqMrlpA+Ql4WjDvIswqrS5nNxGY

    Score
    8/10
    upxdefense_evasionexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks