Extracted

• • Target

    S7fiTRL.exe

  • Size

    56KB

  • MD5

    c8723bca6d83cbad8cbc75ae323d749d

  • SHA1

    e40e8e84186286495aaff872e74afd6bd9c0aafd

  • SHA256

    6688a94f9872a333a01e925207a7a356dfb8e7083926cd5218a572ec67c2d458

  • SHA512

    28e902f13fbd8cca7cab58df38306d85e62c98eced62e96bffce205a3bdf1f0f411830ed77373905ba6ae040536dc6da188fbdaec1db6f63e97e50e50c5a9700

  • SSDEEP

    1536:DMOiQ4BKCxOhU8WdJmQ/KawN9Qe6cr9bAJZXjof4vLa0:DxizBKCyU8WdJmQ/KawN9/r9bAJZXjiY

  Score

  10^/10

  litehttpbotdefense_evasionexecutionpersistenceprivilege_escalationstealer

  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp

  • Litehttp family

    litehttp

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • System Binary Proxy Execution: Verclsid

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  behavioral1behavioral2