Overview

overview

10

Static

static

10

ActSet.exe

windows7-x64

6

ActSet.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ActSet.exe

  • Size

    10.0MB

  • Sample

    241018-hvhq6awepp

  • MD5

    bb228dff85323a06f460a89a398fcdee

  • SHA1

    054291bd2d41e883f38b9323c6b3b7506f8f4d8d

  • SHA256

    505481d658367cfc81bf02fd8f8dbb45c6a48ba14a4b5388e1b14dcc7f7b4d77

  • SHA512

    a17303b0adc164152ee93be6686c7fc80724b686a9e4d19d7ca66a79b0af41ca7fe15d9ce5b51f3285aafdd6ac59f04b0e6e5b1b6c0c48b19f4b6d85432c5d64

  • SSDEEP

    49152:CeNzxKvAI/KnCAjFN2DOjwJHJdVLD4+04p+cn0Jmc9gqSsOp4MQ+FnFrMR5:DCA34pfBGgqSsOV

Score
10/10
fredydiscoveryevasionspywarestealer

Malware Config

Targets

    • Target

      ActSet.exe

    • Size

      10.0MB

    • MD5

      bb228dff85323a06f460a89a398fcdee

    • SHA1

      054291bd2d41e883f38b9323c6b3b7506f8f4d8d

    • SHA256

      505481d658367cfc81bf02fd8f8dbb45c6a48ba14a4b5388e1b14dcc7f7b4d77

    • SHA512

      a17303b0adc164152ee93be6686c7fc80724b686a9e4d19d7ca66a79b0af41ca7fe15d9ce5b51f3285aafdd6ac59f04b0e6e5b1b6c0c48b19f4b6d85432c5d64

    • SSDEEP

      49152:CeNzxKvAI/KnCAjFN2DOjwJHJdVLD4+04p+cn0Jmc9gqSsOp4MQ+FnFrMR5:DCA34pfBGgqSsOV

    Score
    8/10
    discoveryevasionspywarestealer

    • Looks for VMWare Tools registry key

      evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks