Overview

overview

10

Static

static

10

turankyserchets.exe

windows10-2004-x64

8

turankyserchets.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    turankyserchets.exe

  • Size

    7.8MB

  • Sample

    250415-xqpfgawtby

  • MD5

    94dd93a1e09594567ba2f0bc1af13927

  • SHA1

    3d32ca71a96033eb2f9bfe18d9ae7eceea1d1951

  • SHA256

    79bdb910cdbac46bd809d30d00fbffbc4ec040e1149db4e3bd2675bfc7f1cfef

  • SHA512

    e03268ad5a8f23eb2ddaa0a7488b26291360dc5ad52500f4e058ca90be61c8f91e4d61a3e4bbcac3331b6c53dafd6b827b5a60d653a40a0d593ea6aaa818fde8

  • SSDEEP

    196608:KW5HUOXXKApTj9fZwQRCgiIKpdzjPOan7j2y283TOnOt:dxBw8wIKppDO9it

Score
10/10
blankgrabberdefense_evasiondiscoveryexecutionspywarestealerupx

Malware Config

Targets

    • Target

      turankyserchets.exe

    • Size

      7.8MB

    • MD5

      94dd93a1e09594567ba2f0bc1af13927

    • SHA1

      3d32ca71a96033eb2f9bfe18d9ae7eceea1d1951

    • SHA256

      79bdb910cdbac46bd809d30d00fbffbc4ec040e1149db4e3bd2675bfc7f1cfef

    • SHA512

      e03268ad5a8f23eb2ddaa0a7488b26291360dc5ad52500f4e058ca90be61c8f91e4d61a3e4bbcac3331b6c53dafd6b827b5a60d653a40a0d593ea6aaa818fde8

    • SSDEEP

      196608:KW5HUOXXKApTj9fZwQRCgiIKpdzjPOan7j2y283TOnOt:dxBw8wIKppDO9it

    Score
    8/10
    defense_evasiondiscoveryexecutionspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks