Overview

overview

10

Static

static

10

Loader2.exe

windows7-x64

7

Loader2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader2.exe

  • Size

    8.1MB

  • Sample

    250119-map2ystrgn

  • MD5

    a936b08bad62e01047e41999ff671141

  • SHA1

    c93cbfda2c9224c4f2afbd2286a39e4c3b79dd26

  • SHA256

    0d2c6263f5f245dfcc4db129de49be8d9837878d2583e03dea97eab7153bd26e

  • SHA512

    aeab492177d0b9fcb96a36b89c595c5ab0c40d22082661d58ca04e7be4e07eee4bbf829f992b3d086f6f4ad45f17f2a7494714c88b47fed6f54ecfbf4ea322b3

  • SSDEEP

    196608:s4Y3hEsOshoKMuIkhVastRL5Di3unSEC1DVNhe:5Y3ysOshouIkPftRL54XL3Nhe

Score
10/10
blankgrabberexecutionspywarestealerupx

Malware Config

Targets

    • Target

      Loader2.exe

    • Size

      8.1MB

    • MD5

      a936b08bad62e01047e41999ff671141

    • SHA1

      c93cbfda2c9224c4f2afbd2286a39e4c3b79dd26

    • SHA256

      0d2c6263f5f245dfcc4db129de49be8d9837878d2583e03dea97eab7153bd26e

    • SHA512

      aeab492177d0b9fcb96a36b89c595c5ab0c40d22082661d58ca04e7be4e07eee4bbf829f992b3d086f6f4ad45f17f2a7494714c88b47fed6f54ecfbf4ea322b3

    • SSDEEP

      196608:s4Y3hEsOshoKMuIkhVastRL5Di3unSEC1DVNhe:5Y3ysOshouIkPftRL54XL3Nhe

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks