Overview

overview

10

Static

static

10

Executor.exe

windows11-21h2-x64

8

Resubmissions

27-10-2024 21:32

241027-1d2f2sshme 10

27-10-2024 14:03

241027-rc4eksygpl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Executor.exe

  • Size

    6.9MB

  • Sample

    241027-rc4eksygpl

  • MD5

    33634365031cdcf92efb5b9417d1c489

  • SHA1

    3c1fdcbbb5ecdb3e635fd186288306a9770a6452

  • SHA256

    fcbf796a1a32b4d8ca59b8593430282656839fb950194faf616dced42e9ec70f

  • SHA512

    994329768ece88058b4d6d81b43e3868391d4bc3d798dd7f6ba3c2d895dc05c0fbeec139db3b36da2f3ee0eadf8976cf7a9349180d3431edaa30bceebaf3ca34

  • SSDEEP

    98304:bQDjWM8JEE1rpamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIFW2:bQ0UeNTfm/pf+xk4dWRptrbWOjgr0

Score
10/10
blankgrabberexecutionspywarestealerupx

Malware Config

Targets

    • Target

      Executor.exe

    • Size

      6.9MB

    • MD5

      33634365031cdcf92efb5b9417d1c489

    • SHA1

      3c1fdcbbb5ecdb3e635fd186288306a9770a6452

    • SHA256

      fcbf796a1a32b4d8ca59b8593430282656839fb950194faf616dced42e9ec70f

    • SHA512

      994329768ece88058b4d6d81b43e3868391d4bc3d798dd7f6ba3c2d895dc05c0fbeec139db3b36da2f3ee0eadf8976cf7a9349180d3431edaa30bceebaf3ca34

    • SSDEEP

      98304:bQDjWM8JEE1rpamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIFW2:bQ0UeNTfm/pf+xk4dWRptrbWOjgr0

    Score
    8/10
    executionspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks