8ae0a56fdf894c66cb7dcc25d4eac377acb4d32c8b4c936605d5d0c541a608c9 | Triage

Sharing

General

Target

8ae0a56fdf894c66cb7dcc25d4eac377acb4d32c8b4c936605d5d0c541a608c9
Size

564KB
Sample

221020-n8mj6acgaj
MD5

96608674a01049b54cc2d6d451a86740
SHA1

0418d229cefc24cf1524943ec58b0282ef5cf8ca
SHA256

8ae0a56fdf894c66cb7dcc25d4eac377acb4d32c8b4c936605d5d0c541a608c9
SHA512

c591ea310da69997484664f4f13ce7e92ea4f52f4653606ac95a7316d2bfc06afda619ab538bf84a14cacff664622e66df8c704d0f27b3000a7cdeeaa70648c0
SSDEEP

12288:uTp9LIfVF9ZSUpPqIpPPuc5DYXeoJKtm3Y6OFvgt6Yf:UbLouUpCcPj5DqeGKxFvgt6m

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  8ae0a56fdf894c66cb7dcc25d4eac377acb4d32c8b4c936605d5d0c541a608c9
- Size
  
  564KB
- MD5
  
  96608674a01049b54cc2d6d451a86740
- SHA1
  
  0418d229cefc24cf1524943ec58b0282ef5cf8ca
- SHA256
  
  8ae0a56fdf894c66cb7dcc25d4eac377acb4d32c8b4c936605d5d0c541a608c9
- SHA512
  
  c591ea310da69997484664f4f13ce7e92ea4f52f4653606ac95a7316d2bfc06afda619ab538bf84a14cacff664622e66df8c704d0f27b3000a7cdeeaa70648c0
- SSDEEP
  
  12288:uTp9LIfVF9ZSUpPqIpPPuc5DYXeoJKtm3Y6OFvgt6Yf:UbLouUpCcPj5DqeGKxFvgt6m
Score

10^/10

evasion persistence trojan spyware stealer
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencespywarestealertrojan