b295ed4b4a8b181ef01cc26b287680cf16382fae04f7f543f2a07cbf2384a543 | Triage

Sharing

General

Target

b295ed4b4a8b181ef01cc26b287680cf16382fae04f7f543f2a07cbf2384a543
Size

9.3MB
Sample

220511-c6p2qadhd7
MD5

f7be976c9448692768dfd12368ec1305
SHA1

69686db7d03203e025e67f5f814116f6c482c2d7
SHA256

b295ed4b4a8b181ef01cc26b287680cf16382fae04f7f543f2a07cbf2384a543
SHA512

b6d89cb31972939e7737290a90c08d484b3992afb4fc7942f74b44b9b025e32157a010643c30e8c347fc358d05f4b8d8ca72185716ffa39de6224877555f106f

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  b295ed4b4a8b181ef01cc26b287680cf16382fae04f7f543f2a07cbf2384a543
- Size
  
  9.3MB
- MD5
  
  f7be976c9448692768dfd12368ec1305
- SHA1
  
  69686db7d03203e025e67f5f814116f6c482c2d7
- SHA256
  
  b295ed4b4a8b181ef01cc26b287680cf16382fae04f7f543f2a07cbf2384a543
- SHA512
  
  b6d89cb31972939e7737290a90c08d484b3992afb4fc7942f74b44b9b025e32157a010643c30e8c347fc358d05f4b8d8ca72185716ffa39de6224877555f106f
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

behavioral2