ef9736c257823512b9cd74f77f351e7440e98174eca7c658b42056c8fb8d6aa0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef9736c257823512b9cd74f77f351e7440e98174eca7c658b42056c8fb8d6aa0
Size

230KB
Sample

221011-24pqlsadgp
MD5

7a64d53f13751e41b11f5ebe77afdd44
SHA1

1457522c73350e2f5149ceded5f8119481263612
SHA256

ef9736c257823512b9cd74f77f351e7440e98174eca7c658b42056c8fb8d6aa0
SHA512

f6e70e6b3165dc600bef7c5fae6a94dc7ca18e5fcb50b7cd6e2f8088af2ade1dae622fe44b7546478027aa27ef0b0668a4a8dc590207973b2c582a2a50e2f8f4
SSDEEP

3072:FyyBbcGtC+uNd8rfGP7ySf13i+CcLZMQBPp1IkxNRDTCaXAqOx5H02bu:/U5D8rfYTDKEPp1IkxNRfzVCeX

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  ef9736c257823512b9cd74f77f351e7440e98174eca7c658b42056c8fb8d6aa0
- Size
  
  230KB
- MD5
  
  7a64d53f13751e41b11f5ebe77afdd44
- SHA1
  
  1457522c73350e2f5149ceded5f8119481263612
- SHA256
  
  ef9736c257823512b9cd74f77f351e7440e98174eca7c658b42056c8fb8d6aa0
- SHA512
  
  f6e70e6b3165dc600bef7c5fae6a94dc7ca18e5fcb50b7cd6e2f8088af2ade1dae622fe44b7546478027aa27ef0b0668a4a8dc590207973b2c582a2a50e2f8f4
- SSDEEP
  
  3072:FyyBbcGtC+uNd8rfGP7ySf13i+CcLZMQBPp1IkxNRDTCaXAqOx5H02bu:/U5D8rfYTDKEPp1IkxNRfzVCeX
Score

8^/10

discovery evasion spyware stealer trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionspywarestealertrojan

behavioral2