Overview

overview

10

Static

static

10

ac.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac.exe

  • Size

    17.9MB

  • Sample

    241002-zs65eazdpf

  • MD5

    bd5d4a1b8a3573189f2517b8c48bf3b2

  • SHA1

    bb4774ae5a2213cd40ab83d7332e9ecc2e69a995

  • SHA256

    55adc91c65d70db0e5c8be9dccbf7125b38267cf306a0e0e4a8854d3ce42abb4

  • SHA512

    db5f411eeb275b84cbb41fe40406755c6caea4b9382ed997ed207dbf5ec7bc49a712d65968bc2c2295cc88358ddf0e79a4dcc6099483da6365a5f1b5fe89827e

  • SSDEEP

    393216:rqPnLFXlrGBQ+DOETgsvfGSgE+mvEjayy/VOIXTq:+PLFXNGBQ/EbZU2X/Vq

Score
10/10
empyreandiscoverypersistencepyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      ac.exe

    • Size

      17.9MB

    • MD5

      bd5d4a1b8a3573189f2517b8c48bf3b2

    • SHA1

      bb4774ae5a2213cd40ab83d7332e9ecc2e69a995

    • SHA256

      55adc91c65d70db0e5c8be9dccbf7125b38267cf306a0e0e4a8854d3ce42abb4

    • SHA512

      db5f411eeb275b84cbb41fe40406755c6caea4b9382ed997ed207dbf5ec7bc49a712d65968bc2c2295cc88358ddf0e79a4dcc6099483da6365a5f1b5fe89827e

    • SSDEEP

      393216:rqPnLFXlrGBQ+DOETgsvfGSgE+mvEjayy/VOIXTq:+PLFXNGBQ/EbZU2X/Vq

    Score
    7/10
    discoverypersistencespywarestealerupx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks