Overview

overview

8

Static

static

3

file.exe

windows10-2004-x64

8

file.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.exe
  • Size 91KB
  • Sample260629-1rt9wsf15v
  • SHA256 9ccc39a1773dd571dcbfcaefec9918a3ede8c8bd216cfe523a28965bb8b48b09
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectiondefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target
      file.exe
    • Size 91KB
    • SHA256 9ccc39a1773dd571dcbfcaefec9918a3ede8c8bd216cfe523a28965bb8b48b09
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    collectiondefense_evasiondiscoverypersistencespywarestealertrojan

    • Adds policy Run key to start application

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks