Overview

overview

8

Static

static

1

reasl-.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    reasl-.exe

  • Size

    54.9MB

  • Sample

    240704-tajcqsyekm

  • MD5

    d357ac66097254aa58cdecce42f407e2

  • SHA1

    f48b6336f458bf39dd1244f96d870b89b828968f

  • SHA256

    12ebda72ae1f323de1350f46caa98e7f78c5064681b5fa9c1fc0d67a1b21b537

  • SHA512

    22f6a4cea32029671c0ea723a3793f3b5e5ab62b00cc052390368f56fd5ed381cdfaf92d83036038354ab359a79d13a4af9eaf1d6c15f246c4774911a26da93e

  • SSDEEP

    786432:3e9X7QqMoknvNpA+vIlo0FdGgCdb5+KvIFVOjXESWqE5SezWNtyy2SFsLB:3gLQqMrlpA+Ql4JdHvIFVO8qQZby49

Score
8/10
defense_evasionexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      reasl-.exe

    • Size

      54.9MB

    • MD5

      d357ac66097254aa58cdecce42f407e2

    • SHA1

      f48b6336f458bf39dd1244f96d870b89b828968f

    • SHA256

      12ebda72ae1f323de1350f46caa98e7f78c5064681b5fa9c1fc0d67a1b21b537

    • SHA512

      22f6a4cea32029671c0ea723a3793f3b5e5ab62b00cc052390368f56fd5ed381cdfaf92d83036038354ab359a79d13a4af9eaf1d6c15f246c4774911a26da93e

    • SSDEEP

      786432:3e9X7QqMoknvNpA+vIlo0FdGgCdb5+KvIFVOjXESWqE5SezWNtyy2SFsLB:3gLQqMrlpA+Ql4JdHvIFVO8qQZby49

    Score
    8/10
    defense_evasionexecutionpersistenceprivilege_escalationspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks