b08e198a1e5528ab3250a3024e75d6546e79695768fd78d94a20450247d19f01 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b08e198a1e5528ab3250a3024e75d6546e79695768fd78d94a20450247d19f01
Size

136KB
Sample

221020-sx67msbgh4
MD5

80e4d8b7737999bd927d87282cdb2455
SHA1

0cd2f503ff244fd4d957d21eba8eded0b28fcee8
SHA256

b08e198a1e5528ab3250a3024e75d6546e79695768fd78d94a20450247d19f01
SHA512

e96493179911184931a8892f08edd21889b016b54b8871105faa8adc1f759c08ee19e72c10ac290f273125da1cff65eab3a2b292d9e33e5f56f73c0a8b9f1ce7
SSDEEP

1536:jDB+DkDjl8fO1Qkzx3ToFuJL0tC0NH7no47MYTK4iKEFXvxKqHs:fB+DkDZs5kZToTtCiH7nN70/Xey

Score

9^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  b08e198a1e5528ab3250a3024e75d6546e79695768fd78d94a20450247d19f01
- Size
  
  136KB
- MD5
  
  80e4d8b7737999bd927d87282cdb2455
- SHA1
  
  0cd2f503ff244fd4d957d21eba8eded0b28fcee8
- SHA256
  
  b08e198a1e5528ab3250a3024e75d6546e79695768fd78d94a20450247d19f01
- SHA512
  
  e96493179911184931a8892f08edd21889b016b54b8871105faa8adc1f759c08ee19e72c10ac290f273125da1cff65eab3a2b292d9e33e5f56f73c0a8b9f1ce7
- SSDEEP
  
  1536:jDB+DkDjl8fO1Qkzx3ToFuJL0tC0NH7no47MYTK4iKEFXvxKqHs:fB+DkDZs5kZToTtCiH7nN70/Xey
Score

9^/10

persistence spyware stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Account Manipulation

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Account Manipulation

Credentials in Files

Discovery

Process Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer