876d6a9260cb642fc3bee3589efcaf0ac1d27c81ae51d3433c3abedd96b28ef4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

876d6a9260cb642fc3bee3589efcaf0ac1d27c81ae51d3433c3abedd96b28ef4
Size

201KB
Sample

221011-lrh5asggen
MD5

662dae5e8a35edebc33c855e7962de2c
SHA1

6f681a3f70d86ef59935c5641900d7aba46297ae
SHA256

876d6a9260cb642fc3bee3589efcaf0ac1d27c81ae51d3433c3abedd96b28ef4
SHA512

db707c67821c395efa82b7c08fbe4b8321608d60a8af602008a1da66ab399b237a290200767d5dd5ff24543d8762ccf5240850c9c287c26a0a0bea559752b781
SSDEEP

6144:W46tGdyr6iGUDTWwqKNZ0haqxAArcc6l:W3N22ox

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  876d6a9260cb642fc3bee3589efcaf0ac1d27c81ae51d3433c3abedd96b28ef4
- Size
  
  201KB
- MD5
  
  662dae5e8a35edebc33c855e7962de2c
- SHA1
  
  6f681a3f70d86ef59935c5641900d7aba46297ae
- SHA256
  
  876d6a9260cb642fc3bee3589efcaf0ac1d27c81ae51d3433c3abedd96b28ef4
- SHA512
  
  db707c67821c395efa82b7c08fbe4b8321608d60a8af602008a1da66ab399b237a290200767d5dd5ff24543d8762ccf5240850c9c287c26a0a0bea559752b781
- SSDEEP
  
  6144:W46tGdyr6iGUDTWwqKNZ0haqxAArcc6l:W3N22ox
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2