Overview

overview

7

Static

static

cS7il0zOGtdU05K.exe

windows7_x64

7

cS7il0zOGtdU05K.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cS7il0zOGtdU05K.exe

  • Size

    364KB

  • Sample

    200712-ygf87577c2

  • MD5

    b0cac1cdd3c9ab7d332811850ddd8ab9

  • SHA1

    750deac873706d16c1180ac9c3eda6f435828c3e

  • SHA256

    5300a0a0ca9bc1ac90ad1543fe3a1687db23b8f05194f86263938c57e0503b84

  • SHA512

    ebf73440a56091edacee8f04eb61f7aba66f5ca024bb3a10937eb41462146ab48295a9419e0e44fc5c5ec47affa0baf212555411a5f3f09ca9a946e20c3372fc

Score
7/10
evasionpersistencespywaretrojan

Malware Config

Targets

    • Target

      cS7il0zOGtdU05K.exe

    • Size

      364KB

    • MD5

      b0cac1cdd3c9ab7d332811850ddd8ab9

    • SHA1

      750deac873706d16c1180ac9c3eda6f435828c3e

    • SHA256

      5300a0a0ca9bc1ac90ad1543fe3a1687db23b8f05194f86263938c57e0503b84

    • SHA512

      ebf73440a56091edacee8f04eb61f7aba66f5ca024bb3a10937eb41462146ab48295a9419e0e44fc5c5ec47affa0baf212555411a5f3f09ca9a946e20c3372fc

    Score
    7/10
    evasiontrojanspywarepersistence

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks