94c66301ab6fdec5629f959863dbf9cc5ca1f81b00c173a0017fa5ba3aee6b03

General

Target

94c66301ab6fdec5629f959863dbf9cc5ca1f81b00c173a0017fa5ba3aee6b03
Size

5.8MB
Sample

240629-anv4xawdmc
MD5

6d6bb922a210e712b996824df9c340f2
SHA1

fe93c4ccc29144b4f0cb0c9734eb00dbbdf5c5c0
SHA256

94c66301ab6fdec5629f959863dbf9cc5ca1f81b00c173a0017fa5ba3aee6b03
SHA512

33ea02cc143e5578e90c114282b9472c623c67a43bb2bc0c4ad0d6dabb8ae9e8169e1e52629689844ce5c644f7af6f068284622cd4b5613d01b887eb39a684fd
SSDEEP

98304:Odix1DBHi52kgkPaP4t18frP3wbzWFimaI7dlot3:YUHi52k5MgbzWFimaI7dle

Score

10^/10

Malware Config

Targets

- Target
  
  94c66301ab6fdec5629f959863dbf9cc5ca1f81b00c173a0017fa5ba3aee6b03
- Size
  
  5.8MB
- MD5
  
  6d6bb922a210e712b996824df9c340f2
- SHA1
  
  fe93c4ccc29144b4f0cb0c9734eb00dbbdf5c5c0
- SHA256
  
  94c66301ab6fdec5629f959863dbf9cc5ca1f81b00c173a0017fa5ba3aee6b03
- SHA512
  
  33ea02cc143e5578e90c114282b9472c623c67a43bb2bc0c4ad0d6dabb8ae9e8169e1e52629689844ce5c644f7af6f068284622cd4b5613d01b887eb39a684fd
- SSDEEP
  
  98304:Odix1DBHi52kgkPaP4t18frP3wbzWFimaI7dlot3:YUHi52k5MgbzWFimaI7dle
Score

9^/10

adware persistence spyware stealer upx
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

UPX dump on OEP (original entry point)

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Enumerates connected drives

Installs/modifies Browser Helper Object

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2