Overview

overview

10

Static

static

3

63545fa195...8a.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

  • Size

    324KB

  • Sample

    240924-rmh7dssape

  • MD5

    5ab1225f068b14fa0980876f854f3f67

  • SHA1

    3dca45b8720fa370fec59e11030deaa081bf3b8c

  • SHA256

    f6b327501a58f41cbd606e9a5d3b3c4994ccefd667f014601149cf2fd2ce7d58

  • SHA512

    d30014e71737746e9fdc114741b5ca53b1aa20c72a171da94a1ca39d5c25494b3517e03b4fdbed2260e4c02ba6d5f08f9b78488fdb095429443e5840ab2f45a4

  • SSDEEP

    6144:O+vs7sacJYpLQVccva3Kwo+gM/gMvztXbGUhtjrFCP0JW/rhJ7u9/Ifn:3voxcJY2a8lwo+sMvztXbdhtj5CUa9Jz

Score
10/10
mimikatzbootkitdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

    • Size

      390KB

    • MD5

      5b7e6e352bacc93f7b80bc968b6ea493

    • SHA1

      e686139d5ed8528117ba6ca68fe415e4fb02f2be

    • SHA256

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

    • SHA512

      9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

    • SSDEEP

      12288:ef/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:EXATS/x9jNg+95vdQa

    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks