Overview

overview

10

Static

static

1

LDPlayer9_...ld.exe

windows7-x64

10

LDPlayer9_...ld.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LDPlayer9_es_1260_ld.exe

  • Size

    12.3MB

  • Sample

    240825-w2ak1szapn

  • MD5

    53267fb7397aef58b1025636f8eed6b8

  • SHA1

    bc2e7965b2a5d10de452dd590ffef7328b48e1bf

  • SHA256

    815165ed2cfb5dee2b8c061f6436366b9d72e464dcc83db9c3c036475a875d5e

  • SHA512

    bd966609dc941d64bb379913a8258f2c8b9712e76c8ea5a4c5f842aa86714c1a39d918b71f170491c08e40ffe6f6fe236a7cd025b93902b75080adb43056af9f

  • SSDEEP

    393216:P9JRaxbxp41TXj2w5311sHznZc+TEI4gw:1ibxWT6w5AbZbTNC

Score
10/10
guerrillaotpstealerdiscoveryexecutionexploitinfostealerpersistenceprivilege_escalationratspywaretrojan

Malware Config

Targets

    • Target

      LDPlayer9_es_1260_ld.exe

    • Size

      12.3MB

    • MD5

      53267fb7397aef58b1025636f8eed6b8

    • SHA1

      bc2e7965b2a5d10de452dd590ffef7328b48e1bf

    • SHA256

      815165ed2cfb5dee2b8c061f6436366b9d72e464dcc83db9c3c036475a875d5e

    • SHA512

      bd966609dc941d64bb379913a8258f2c8b9712e76c8ea5a4c5f842aa86714c1a39d918b71f170491c08e40ffe6f6fe236a7cd025b93902b75080adb43056af9f

    • SSDEEP

      393216:P9JRaxbxp41TXj2w5311sHznZc+TEI4gw:1ibxWT6w5AbZbTNC

    Score
    10/10
    guerrillaotpstealerdiscoveryexecutionexploitinfostealerpersistenceprivilege_escalationratspywaretrojan

    • Guerrilla

      Guerrilla is an Android malware used by the Lemon Group threat actor.

      trojaninfostealerratguerrilla

    • Guerrilla payload

    • Otpstealer

      Otpstealer is an Android SMS Stealer that targets OTP first seen in February 2022.

      trojaninfostealerspywareotpstealer

    • Otpstealer payload

    • Creates new service(s)

      persistenceexecution

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Possible privilege escalation attempt

      exploit

    • Modifies file permissions

      discovery

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks