Extracted

• • Target

    builder.exe

  • Size

    470KB

  • MD5

    8c689dc9e82c9356b990d2b67b4943e1

  • SHA1

    6bdc415b9c356bbeaea75c7336cd72910b95a644

  • SHA256

    e8e2deb0a83aebb1e2cc14846bc71715343372103f279d2d1622e383fb26d6ef

  • SHA512

    fb38a79dbcebde149736d5e1ca37dc15d274838be304d3f86e992d610b50c31d7fe4c30f6697c890f3753443af16eab712aef3f8da88d76ed00790083deb51e4

  • SSDEEP

    12288:7tDkI5O/1MHOvEIfRfaXNCTL98vy7anEvY86vM1kiY4XotXpEKAoiO5wBmrkAUfM:7tQcOdu4BcCTL98vy7anEvY86vM1kiYt

  Score

  8^/10

  adwaredefense_evasiondiscoverypersistenceprivilege_escalationstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1