9db4c25f8f3b581dd0206aaa7005c42a91e9cce1ac6e0c1555fb679f158c2659 | Triage

Sharing

General

Target

9db4c25f8f3b581dd0206aaa7005c42a91e9cce1ac6e0c1555fb679f158c2659
Size

866KB
Sample

210513-wg4ra158ca
MD5

b672ee658d882ec1210efca32d921261
SHA1

2c2e98eb14eec43092ab50bf45ba63daf84f73ba
SHA256

9db4c25f8f3b581dd0206aaa7005c42a91e9cce1ac6e0c1555fb679f158c2659
SHA512

a1278c9209609b19048a7aa19e99d03ef0a71e02faff764446e549698801607285ecedd1854035f840059a290d1cbff799412090c7ad6563dd0be482d0960169

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  9db4c25f8f3b581dd0206aaa7005c42a91e9cce1ac6e0c1555fb679f158c2659
- Size
  
  866KB
- MD5
  
  b672ee658d882ec1210efca32d921261
- SHA1
  
  2c2e98eb14eec43092ab50bf45ba63daf84f73ba
- SHA256
  
  9db4c25f8f3b581dd0206aaa7005c42a91e9cce1ac6e0c1555fb679f158c2659
- SHA512
  
  a1278c9209609b19048a7aa19e99d03ef0a71e02faff764446e549698801607285ecedd1854035f840059a290d1cbff799412090c7ad6563dd0be482d0960169
Score

7^/10

persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer