40559c73c9ff1fe763f3746f0e4a63eacc42af0b43a147de91504f69b6bc1a3d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40559c73c9ff1fe763f3746f0e4a63eacc42af0b43a147de91504f69b6bc1a3d
Size

212KB
Sample

221003-t4zltafadj
MD5

32b83267e5b024b20b1d006a72e1d6d0
SHA1

688bd87d2f2102f61193e50a151315db7721547d
SHA256

40559c73c9ff1fe763f3746f0e4a63eacc42af0b43a147de91504f69b6bc1a3d
SHA512

54cd797c45bf57f6998925c69a89d3e6827078e942e08324fb9aff96305fc2c6113f8fe96706813e6f62daf8d262ec66357c652cec35e342acb309613799f69f
SSDEEP

3072:KQDe+aDtreDF6+FwYa2tf3d3CJPfmPDeKEc8GREDLYICEYFOUUzfPwVDpDO:dS+aY32YhtEx9c8ypICEYFOREVS

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  40559c73c9ff1fe763f3746f0e4a63eacc42af0b43a147de91504f69b6bc1a3d
- Size
  
  212KB
- MD5
  
  32b83267e5b024b20b1d006a72e1d6d0
- SHA1
  
  688bd87d2f2102f61193e50a151315db7721547d
- SHA256
  
  40559c73c9ff1fe763f3746f0e4a63eacc42af0b43a147de91504f69b6bc1a3d
- SHA512
  
  54cd797c45bf57f6998925c69a89d3e6827078e942e08324fb9aff96305fc2c6113f8fe96706813e6f62daf8d262ec66357c652cec35e342acb309613799f69f
- SSDEEP
  
  3072:KQDe+aDtreDF6+FwYa2tf3d3CJPfmPDeKEc8GREDLYICEYFOUUzfPwVDpDO:dS+aY32YhtEx9c8ypICEYFOREVS
Score

8^/10

spyware stealer
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2