Overview

overview

10

Static

static

10

Built.exe

windows7-x64

7

Built.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    8.2MB

  • Sample

    250104-19hntasldm

  • MD5

    4896fe655b635db5f57d9304503ce7c1

  • SHA1

    342d2d8c020c37d15993b3bab8244ea36f7bdba3

  • SHA256

    d38b5348bb59c5eca446c0808cffa07a46e31133efaefffcdf824cd8a9a84a90

  • SHA512

    ae1d73a1801aecc060939159962b1a6ef2699c661e2afd6252f09afc23e3b892f01de99538185bb536d5f1376e2ea268d2b9710296917c90817dcf2fe6f8aa9b

  • SSDEEP

    196608:HD+A++lurErvI9pWjgfPvzm6gs/SEjE+Ss:j+elurEUWjC3zDAaos

Score
10/10
blankgrabberexecutionspywarestealerupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      8.2MB

    • MD5

      4896fe655b635db5f57d9304503ce7c1

    • SHA1

      342d2d8c020c37d15993b3bab8244ea36f7bdba3

    • SHA256

      d38b5348bb59c5eca446c0808cffa07a46e31133efaefffcdf824cd8a9a84a90

    • SHA512

      ae1d73a1801aecc060939159962b1a6ef2699c661e2afd6252f09afc23e3b892f01de99538185bb536d5f1376e2ea268d2b9710296917c90817dcf2fe6f8aa9b

    • SSDEEP

      196608:HD+A++lurErvI9pWjgfPvzm6gs/SEjE+Ss:j+elurEUWjC3zDAaos

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks