0b7bef52d773bd59c1540e0f416f8665d5bc1d69d998246368b06ac2a7dfc00d | Triage

Sharing

General

Target

0b7bef52d773bd59c1540e0f416f8665d5bc1d69d998246368b06ac2a7dfc00d
Size

264KB
Sample

220530-dgfbnabfb7
MD5

4716e1ece995483a7218df80bc8956d6
SHA1

453684c742ba590b0e5d973cebe019f091958ec6
SHA256

0b7bef52d773bd59c1540e0f416f8665d5bc1d69d998246368b06ac2a7dfc00d
SHA512

163db67ba0c82471c5e9349ec3895114d367a4346b7359091fc059edd4966cbe4782d8210060e1f4413f2458e57417b9af01ff1d4e7dc8c5b88295640b08a4c9

Score

8^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  0b7bef52d773bd59c1540e0f416f8665d5bc1d69d998246368b06ac2a7dfc00d
- Size
  
  264KB
- MD5
  
  4716e1ece995483a7218df80bc8956d6
- SHA1
  
  453684c742ba590b0e5d973cebe019f091958ec6
- SHA256
  
  0b7bef52d773bd59c1540e0f416f8665d5bc1d69d998246368b06ac2a7dfc00d
- SHA512
  
  163db67ba0c82471c5e9349ec3895114d367a4346b7359091fc059edd4966cbe4782d8210060e1f4413f2458e57417b9af01ff1d4e7dc8c5b88295640b08a4c9
Score

8^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistencespywarestealer