Overview

overview

10

Static

static

10

loader_prod Crack.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    loader_prod Crack.exe

  • Size

    7.4MB

  • Sample

    240708-ad7pyssgnk

  • MD5

    846db9a3af4ec635d2aab60128a7dfdf

  • SHA1

    c5360129c20730fc204a9d4d9a10f9741857dec1

  • SHA256

    662cf670313f117f20e13db186ff69f7c9fd9aeb808c3fc9527a33b356ba370d

  • SHA512

    77ec8c4887f93aa4a2efb46ff89857cd4b88a7989e643099298d0316e444fde79071d218f6e8c717328218cdbf374e46b6a2536cddb2c898151ddae6caa2212e

  • SSDEEP

    196608:ciP9VHkwurErvI9pWjgfPvzm6gsFEB4AuY:dltkwurEUWjC3zDb84AuY

Score
10/10
blankgrabberexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      loader_prod Crack.exe

    • Size

      7.4MB

    • MD5

      846db9a3af4ec635d2aab60128a7dfdf

    • SHA1

      c5360129c20730fc204a9d4d9a10f9741857dec1

    • SHA256

      662cf670313f117f20e13db186ff69f7c9fd9aeb808c3fc9527a33b356ba370d

    • SHA512

      77ec8c4887f93aa4a2efb46ff89857cd4b88a7989e643099298d0316e444fde79071d218f6e8c717328218cdbf374e46b6a2536cddb2c898151ddae6caa2212e

    • SSDEEP

      196608:ciP9VHkwurErvI9pWjgfPvzm6gsFEB4AuY:dltkwurEUWjC3zDb84AuY

    Score
    8/10
    executionpersistenceprivilege_escalationspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in Drivers directory

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks