57a4675a8231450ac70c34e2c52133eb3efc7424879abe9726167fbd0941e610 | Triage

Sharing

General

Target

57a4675a8231450ac70c34e2c52133eb3efc7424879abe9726167fbd0941e610
Size

839KB
Sample

221011-ntg15acgbl
MD5

7d4581d7703b7933722c5fd137f81e10
SHA1

1b3b262e36e5387c51eb63979d0cf524d2c00323
SHA256

57a4675a8231450ac70c34e2c52133eb3efc7424879abe9726167fbd0941e610
SHA512

12e2986042b99707f1b846e8a4bdac4f7eb3aba3e6597694d39e50425e38eaa461f9c054ac21c79339dba6425649042918af3909bc6c8c75d25e3e5b56dee6be
SSDEEP

24576:qu1ovvVfgIputUYjbkw0RSkafKynT4ZbTO:PovvK+uOYjbTkafKynw6

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  57a4675a8231450ac70c34e2c52133eb3efc7424879abe9726167fbd0941e610
- Size
  
  839KB
- MD5
  
  7d4581d7703b7933722c5fd137f81e10
- SHA1
  
  1b3b262e36e5387c51eb63979d0cf524d2c00323
- SHA256
  
  57a4675a8231450ac70c34e2c52133eb3efc7424879abe9726167fbd0941e610
- SHA512
  
  12e2986042b99707f1b846e8a4bdac4f7eb3aba3e6597694d39e50425e38eaa461f9c054ac21c79339dba6425649042918af3909bc6c8c75d25e3e5b56dee6be
- SSDEEP
  
  24576:qu1ovvVfgIputUYjbkw0RSkafKynT4ZbTO:PovvK+uOYjbTkafKynw6
Score

10^/10

evasion persistence spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealertrojan

behavioral2

evasionpersistencespywarestealertrojan