Overview

overview

8

Static

static

de4419c014...76.exe

windows7_x64

8

de4419c014...76.exe

windows10_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    de4419c0142a84761ed9abddcbc8bd76
  • Size 351KB
  • Sample211010-dafnvafee4
  • SHA256 4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91
  • MD5 SHA1 SHA512
Score
8/10
collectionspywarestealervmprotect

Malware Config

Targets

    • Target
      de4419c0142a84761ed9abddcbc8bd76
    • Size 351KB
    • SHA256 4e7a2d297395633bb98f5a8e2c51ed41bad9e7b8917eca00aa9b83517d16eb91
    • MD5 SHA1 SHA512
    Score
    8/10
    vmprotectcollectionspywarestealer

    • Downloads MZ/PE file

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks