4f4fcb2ba4ec57969a0dd7be28b13d8a1041878530bdcf546770db1353fffe02 | Triage

Sharing

General

Target

4f4fcb2ba4ec57969a0dd7be28b13d8a1041878530bdcf546770db1353fffe02
Size

877KB
Sample

221002-g6rb1adbbm
MD5

6c5e25c0a06418934f60915e654ecac0
SHA1

11d53cc056e56aba2e58ae16d4791b318897301a
SHA256

4f4fcb2ba4ec57969a0dd7be28b13d8a1041878530bdcf546770db1353fffe02
SHA512

c7767503d42c2dab4d1a0ba32df8f81c8116c9ea641277c0964474898e508dbcfb4eeb657efbb320e002a53d9b87617dec7bd93304402a6b42072f7123277035
SSDEEP

12288:h1OgLdaOXuunhwyAcnpDcorrLWweor+SVhZJy5rzELMMzUDX3WsN1eotA:h1OYdaO+uRx+oz5HVhuzAVoLHXtA

Score

8^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  4f4fcb2ba4ec57969a0dd7be28b13d8a1041878530bdcf546770db1353fffe02
- Size
  
  877KB
- MD5
  
  6c5e25c0a06418934f60915e654ecac0
- SHA1
  
  11d53cc056e56aba2e58ae16d4791b318897301a
- SHA256
  
  4f4fcb2ba4ec57969a0dd7be28b13d8a1041878530bdcf546770db1353fffe02
- SHA512
  
  c7767503d42c2dab4d1a0ba32df8f81c8116c9ea641277c0964474898e508dbcfb4eeb657efbb320e002a53d9b87617dec7bd93304402a6b42072f7123277035
- SSDEEP
  
  12288:h1OgLdaOXuunhwyAcnpDcorrLWweor+SVhZJy5rzELMMzUDX3WsN1eotA:h1OYdaO+uRx+oz5HVhuzAVoLHXtA
Score

8^/10

discovery evasion persistence spyware stealer
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealer

behavioral2

discoveryevasionpersistencespywarestealer