5bc9d129f63365ab12dffea13fb695edf0edef3e8ede298e3f17cd07c4aa2d49 | Triage

Sharing

General

Target

5bc9d129f63365ab12dffea13fb695edf0edef3e8ede298e3f17cd07c4aa2d49
Size

105KB
Sample

221011-lrjqtsggep
MD5

708727caf15d7429de1afd47e899d850
SHA1

08f10dfceeac7f286a9745bc53a17af061d407e5
SHA256

5bc9d129f63365ab12dffea13fb695edf0edef3e8ede298e3f17cd07c4aa2d49
SHA512

aa33c32adab0b47fc67c434d34f3e1c8a30965af552ff443d04df23b052bb973a7be3c3127cab11b1ec004a63518d27364e9bb920f9f555a54fc9133c5bf29cf
SSDEEP

3072:PJaY46tGNttyJQ7KRVQzhBJe8eWS/bKAJ:L46tGdyYzhve8eWS/b

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  5bc9d129f63365ab12dffea13fb695edf0edef3e8ede298e3f17cd07c4aa2d49
- Size
  
  105KB
- MD5
  
  708727caf15d7429de1afd47e899d850
- SHA1
  
  08f10dfceeac7f286a9745bc53a17af061d407e5
- SHA256
  
  5bc9d129f63365ab12dffea13fb695edf0edef3e8ede298e3f17cd07c4aa2d49
- SHA512
  
  aa33c32adab0b47fc67c434d34f3e1c8a30965af552ff443d04df23b052bb973a7be3c3127cab11b1ec004a63518d27364e9bb920f9f555a54fc9133c5bf29cf
- SSDEEP
  
  3072:PJaY46tGNttyJQ7KRVQzhBJe8eWS/bKAJ:L46tGdyYzhve8eWS/b
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2