86c0e685069eafa0dead8ad317fc29179d1d3567c8856c053289890ed3e6ff9b | Triage

Sharing

General

Target

86c0e685069eafa0dead8ad317fc29179d1d3567c8856c053289890ed3e6ff9b
Size

8.4MB
Sample

220511-c62qhsdhe4
MD5

f566b9fe6f92d169af877dec2b6a5901
SHA1

0985446919cd7bfaf3300cb71f5e21c9fee18035
SHA256

86c0e685069eafa0dead8ad317fc29179d1d3567c8856c053289890ed3e6ff9b
SHA512

865710b7cff0c036ef0d94e2714c2f3958e804962dba4b2e7cf77ffc15512b46b41b58e02c2bb2c77fa613fc02c6811f9698917ee22f3b6dad71b806d9354008

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  86c0e685069eafa0dead8ad317fc29179d1d3567c8856c053289890ed3e6ff9b
- Size
  
  8.4MB
- MD5
  
  f566b9fe6f92d169af877dec2b6a5901
- SHA1
  
  0985446919cd7bfaf3300cb71f5e21c9fee18035
- SHA256
  
  86c0e685069eafa0dead8ad317fc29179d1d3567c8856c053289890ed3e6ff9b
- SHA512
  
  865710b7cff0c036ef0d94e2714c2f3958e804962dba4b2e7cf77ffc15512b46b41b58e02c2bb2c77fa613fc02c6811f9698917ee22f3b6dad71b806d9354008
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

behavioral2