dc52c91a60a95d0c69177e6eef335b42a2e4f68165142419aea59fe873d1102d | Triage

Sharing

General

Target

dc52c91a60a95d0c69177e6eef335b42a2e4f68165142419aea59fe873d1102d
Size

684KB
Sample

221002-rtbqwsafd2
MD5

706c7452edc5df97bc5a2e9c6a547c80
SHA1

12f492e1e6b343c26fcb4e6e4de42889d2f37225
SHA256

dc52c91a60a95d0c69177e6eef335b42a2e4f68165142419aea59fe873d1102d
SHA512

dd34e76f57edcb63373fa9fffbc882ec46dbbf1acd4310de026116b675b422f21ba102211a448c0b057c701d976b946e31b4d1bb5a456e72b5e5b0cd62398e1e
SSDEEP

12288:MtgyG9ZO6ZDjPtGPO5jy1lXb2eYcL0ouDpGGf04txw03Xt4hKKgcKoC:Mt376Z3PuO5jGlXb2eYqTGVPRt7KVKp

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  dc52c91a60a95d0c69177e6eef335b42a2e4f68165142419aea59fe873d1102d
- Size
  
  684KB
- MD5
  
  706c7452edc5df97bc5a2e9c6a547c80
- SHA1
  
  12f492e1e6b343c26fcb4e6e4de42889d2f37225
- SHA256
  
  dc52c91a60a95d0c69177e6eef335b42a2e4f68165142419aea59fe873d1102d
- SHA512
  
  dd34e76f57edcb63373fa9fffbc882ec46dbbf1acd4310de026116b675b422f21ba102211a448c0b057c701d976b946e31b4d1bb5a456e72b5e5b0cd62398e1e
- SSDEEP
  
  12288:MtgyG9ZO6ZDjPtGPO5jy1lXb2eYcL0ouDpGGf04txw03Xt4hKKgcKoC:Mt376Z3PuO5jGlXb2eYqTGVPRt7KVKp
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer