2c6c444ce3fab26b4ae60ad79a7ba39bf15f439d808add434aed3a5addb960b5 | Triage

Sharing

General

Target

2c6c444ce3fab26b4ae60ad79a7ba39bf15f439d808add434aed3a5addb960b5
Size

167KB
Sample

221011-ashz5sfham
MD5

7ccbe2edd64abadea2521915a6a2c133
SHA1

c1358c0c571586dbbf9e46309f4afdc94968e0be
SHA256

2c6c444ce3fab26b4ae60ad79a7ba39bf15f439d808add434aed3a5addb960b5
SHA512

22d3b8b0f4849a5d54ea6002e90baf971cd1477050f9fdcfcbaf55c7e04afc24b59668567b29a125d250a551a3348ef850ae1267592e9694d46d7a16b6d9d32a
SSDEEP

3072:aE/7tkX8PuEwxavvSxstG1kNE6BJdK5YWIIZ34w7oyN:aY7t2LaCxsoA9d5WjCwf

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  2c6c444ce3fab26b4ae60ad79a7ba39bf15f439d808add434aed3a5addb960b5
- Size
  
  167KB
- MD5
  
  7ccbe2edd64abadea2521915a6a2c133
- SHA1
  
  c1358c0c571586dbbf9e46309f4afdc94968e0be
- SHA256
  
  2c6c444ce3fab26b4ae60ad79a7ba39bf15f439d808add434aed3a5addb960b5
- SHA512
  
  22d3b8b0f4849a5d54ea6002e90baf971cd1477050f9fdcfcbaf55c7e04afc24b59668567b29a125d250a551a3348ef850ae1267592e9694d46d7a16b6d9d32a
- SSDEEP
  
  3072:aE/7tkX8PuEwxavvSxstG1kNE6BJdK5YWIIZ34w7oyN:aY7t2LaCxsoA9d5WjCwf
Score

8^/10

discovery evasion spyware stealer trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionspywarestealertrojan

behavioral2