4682ad39fef4157aeaa497ffc0cd8e9f61915c1aff83d28f47306c9a97d152b9 | Triage

Sharing

General

Target

4682ad39fef4157aeaa497ffc0cd8e9f61915c1aff83d28f47306c9a97d152b9
Size

479KB
Sample

221020-2rkk5aaac8
MD5

4401e035c0f3d776a854ef3cd3cd9080
SHA1

af7eb0ba46b6aae5c5b64c52e3e8a0cceb228de5
SHA256

4682ad39fef4157aeaa497ffc0cd8e9f61915c1aff83d28f47306c9a97d152b9
SHA512

037af2948cc83d17a9f660a91b03fb63e47fdff6b0652161b343307932928136ae91a2be21519e19517c38578b6fa630caaeaa90ccf2bf214f97a87a1bb4877f
SSDEEP

3072:i1e+aX3K1fOHoqnPzErBJQCObI9bjI95xt5YZ3iV1cebaf4xmVoqiCiRSpnzIpTX:L+aX36WHoqnauRb0czOy/

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  4682ad39fef4157aeaa497ffc0cd8e9f61915c1aff83d28f47306c9a97d152b9
- Size
  
  479KB
- MD5
  
  4401e035c0f3d776a854ef3cd3cd9080
- SHA1
  
  af7eb0ba46b6aae5c5b64c52e3e8a0cceb228de5
- SHA256
  
  4682ad39fef4157aeaa497ffc0cd8e9f61915c1aff83d28f47306c9a97d152b9
- SHA512
  
  037af2948cc83d17a9f660a91b03fb63e47fdff6b0652161b343307932928136ae91a2be21519e19517c38578b6fa630caaeaa90ccf2bf214f97a87a1bb4877f
- SSDEEP
  
  3072:i1e+aX3K1fOHoqnPzErBJQCObI9bjI95xt5YZ3iV1cebaf4xmVoqiCiRSpnzIpTX:L+aX36WHoqnauRb0czOy/
Score

8^/10

spyware stealer
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2