d16988f04f7185f67538f9144ed19e6da1a10aff251277888af9792673eac146 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d16988f04f7185f67538f9144ed19e6da1a10aff251277888af9792673eac146
Size

504KB
Sample

221002-yarrbshdek
MD5

6f08ea7749dc4479cbd62df02074de50
SHA1

6e3d374296ab9381c54205497223bba8b1db1040
SHA256

d16988f04f7185f67538f9144ed19e6da1a10aff251277888af9792673eac146
SHA512

d369834f5bd9c79ade8defcf0f7f938df07af504a44f8dc5121c9557e827e14ab5698fc63f2f6a2f6c729b9acd077211db7fcad28c888964c2e3c6377770a189
SSDEEP

12288:Mv59QwjS6gJqOF0+SfvmfKHAPO+p0LSpsMJ4gWCnMUDpzK7o2u5l:QQweZJqOFTSH8OROqgWyZ2wl

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  d16988f04f7185f67538f9144ed19e6da1a10aff251277888af9792673eac146
- Size
  
  504KB
- MD5
  
  6f08ea7749dc4479cbd62df02074de50
- SHA1
  
  6e3d374296ab9381c54205497223bba8b1db1040
- SHA256
  
  d16988f04f7185f67538f9144ed19e6da1a10aff251277888af9792673eac146
- SHA512
  
  d369834f5bd9c79ade8defcf0f7f938df07af504a44f8dc5121c9557e827e14ab5698fc63f2f6a2f6c729b9acd077211db7fcad28c888964c2e3c6377770a189
- SSDEEP
  
  12288:Mv59QwjS6gJqOF0+SfvmfKHAPO+p0LSpsMJ4gWCnMUDpzK7o2u5l:QQweZJqOFTSH8OROqgWyZ2wl
Score

10^/10

evasion persistence spyware stealer trojan
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealertrojan

behavioral2

evasionpersistencespywarestealertrojan