Overview

overview

9

Static

static

3

c5ff75d180...0N.exe

windows7-x64

9

c5ff75d180...0N.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    c5ff75d180c9dbfca3c2f9a5c978f580N

  • Size

    2.6MB

  • Sample

    240915-ee9yxsvcjj

  • MD5

    c5ff75d180c9dbfca3c2f9a5c978f580

  • SHA1

    b0024b4c6dcfe2d257d168271dfc2cf8a7793b94

  • SHA256

    3a4c2b5a8a494b4f2af8e68be9dd04b38224ff0b4499112d63dc3aacdf6509c2

  • SHA512

    fa1f49033f9dbe882e03f3a201507f03ce8a001d559911e17c986a34d88c080a5f48567ec42a4a2b80c9e7b9a5815b817229009ef596a094e112ba182e13bea8

  • SSDEEP

    49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bS:sxX7QnxrloE5dpUpdb

Score
9/10
credential_accessdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      c5ff75d180c9dbfca3c2f9a5c978f580N

    • Size

      2.6MB

    • MD5

      c5ff75d180c9dbfca3c2f9a5c978f580

    • SHA1

      b0024b4c6dcfe2d257d168271dfc2cf8a7793b94

    • SHA256

      3a4c2b5a8a494b4f2af8e68be9dd04b38224ff0b4499112d63dc3aacdf6509c2

    • SHA512

      fa1f49033f9dbe882e03f3a201507f03ce8a001d559911e17c986a34d88c080a5f48567ec42a4a2b80c9e7b9a5815b817229009ef596a094e112ba182e13bea8

    • SSDEEP

      49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBWB/bS:sxX7QnxrloE5dpUpdb

    Score
    9/10
    credential_accessdiscoverypersistencespywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks