fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222 | Triage

Sharing

General

Target

fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222.exe
Size

4.2MB
Sample

221003-d5yg5sfgfq
MD5

94a84e0cd8adda837ceb72d95b88344b
SHA1

29024ecf179764920b871d92bbfd77ff8d6236b1
SHA256

fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222
SHA512

032e3be4cf940c5d4c6ba2470e13955872d87a9279faa5b8fb8e75fc2672af1a62614915c88c90d2e165ab49630934827d796006e8941c0c79436357a0d6a6fb
SSDEEP

49152:5jLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:RLu1TIRtUOV5Zv

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222.exe
- Size
  
  4.2MB
- MD5
  
  94a84e0cd8adda837ceb72d95b88344b
- SHA1
  
  29024ecf179764920b871d92bbfd77ff8d6236b1
- SHA256
  
  fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222
- SHA512
  
  032e3be4cf940c5d4c6ba2470e13955872d87a9279faa5b8fb8e75fc2672af1a62614915c88c90d2e165ab49630934827d796006e8941c0c79436357a0d6a6fb
- SSDEEP
  
  49152:5jLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:RLu1TIRtUOV5Zv
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2