Overview

overview

9

Static

static

3

keygen.exe

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    keygen.exe

  • Size

    16.3MB

  • Sample

    240824-19zmbsvbqr

  • MD5

    f74726db44139713f7da60e7e9d90437

  • SHA1

    1739394d338bcf19ac5d014731778ae0900db934

  • SHA256

    7ea85c2207768125f65e7285b845b1f45e1d20c5a1e3e5bc54c3794266697bfc

  • SHA512

    4538a98422d771e41f7158e559043689a9757a900f7bb1a0ec13d8e316eebebeb766b5e1f16e95bb0d570c972ec75c738f196b5746b30a8e8b7198202805857b

  • SSDEEP

    393216:Ho9Dke6a7v5t5K+7/pWfm5RiJcuriWup9w0+5dj6H:I9gFa7vD5K+7/pWueKZvGj6

Score
9/10
credential_accessdiscoverypyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      keygen.exe

    • Size

      16.3MB

    • MD5

      f74726db44139713f7da60e7e9d90437

    • SHA1

      1739394d338bcf19ac5d014731778ae0900db934

    • SHA256

      7ea85c2207768125f65e7285b845b1f45e1d20c5a1e3e5bc54c3794266697bfc

    • SHA512

      4538a98422d771e41f7158e559043689a9757a900f7bb1a0ec13d8e316eebebeb766b5e1f16e95bb0d570c972ec75c738f196b5746b30a8e8b7198202805857b

    • SSDEEP

      393216:Ho9Dke6a7v5t5K+7/pWfm5RiJcuriWup9w0+5dj6H:I9gFa7vD5K+7/pWueKZvGj6

    Score
    9/10
    credential_accessdiscoveryspywarestealerupx

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks