Overview

overview

7

Static

static

10b2e74fde...5e.exe

windows7_x64

7

10b2e74fde...5e.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e

  • Size

    1.4MB

  • Sample

    200630-m9fj6lcnvn

  • MD5

    cb2c94881fae75774b495548bc9e90f7

  • SHA1

    8411fd9c37200436f94a0459c0205b43d2c06a6c

  • SHA256

    10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e

  • SHA512

    cc4b2e0d704e78bd14edcec0ff6d76f791a40b4a4e416d5a78cfc0b1948a25ebfe7f15a2d1d520e15e5b87c39c3f6c22ab9a22d7e959f110991a86290b79f1c5

Score
7/10
discoverypersistencespyware

Malware Config

Targets

    • Target

      10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e

    • Size

      1.4MB

    • MD5

      cb2c94881fae75774b495548bc9e90f7

    • SHA1

      8411fd9c37200436f94a0459c0205b43d2c06a6c

    • SHA256

      10b2e74fdeacd4b00b7687eca2f1bfe0c30901561453ae6c1b9549406b29615e

    • SHA512

      cc4b2e0d704e78bd14edcec0ff6d76f791a40b4a4e416d5a78cfc0b1948a25ebfe7f15a2d1d520e15e5b87c39c3f6c22ab9a22d7e959f110991a86290b79f1c5

    Score
    7/10
    spywarediscoverypersistence

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Accesses cryptocurrency wallets, possible credential harvesting

      spyware

    • Checks for installed software on the system

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks