91c9e06e0ff399a4eff06cbd2a5512a6144af70de685a26239b02194412faa28 | Triage

Sharing

General

Target

91c9e06e0ff399a4eff06cbd2a5512a6144af70de685a26239b02194412faa28
Size

92KB
Sample

221022-fd9r7saga2
MD5

6ecf287cf8d64e1efb5282166ca5c848
SHA1

44c04b9927d0ff82901205d53e274369a1dbcdc5
SHA256

91c9e06e0ff399a4eff06cbd2a5512a6144af70de685a26239b02194412faa28
SHA512

a591ce0eee936f947b06fbca22e145137ce7745c12a7f46dd380f2898bc9f7c8d9707a55a4562911f10336ebe0a5399cf9dbdc8addb0b32aa1c75e6bcdbf4418
SSDEEP

1536:oDk2FTfrEMFyWXHuQlrYesejnPRq5xemr7kwTmB5j/+mQ8L8Ev:oDk0rhFTXuQegnPyecgw6B5D+mZL82

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  91c9e06e0ff399a4eff06cbd2a5512a6144af70de685a26239b02194412faa28
- Size
  
  92KB
- MD5
  
  6ecf287cf8d64e1efb5282166ca5c848
- SHA1
  
  44c04b9927d0ff82901205d53e274369a1dbcdc5
- SHA256
  
  91c9e06e0ff399a4eff06cbd2a5512a6144af70de685a26239b02194412faa28
- SHA512
  
  a591ce0eee936f947b06fbca22e145137ce7745c12a7f46dd380f2898bc9f7c8d9707a55a4562911f10336ebe0a5399cf9dbdc8addb0b32aa1c75e6bcdbf4418
- SSDEEP
  
  1536:oDk2FTfrEMFyWXHuQlrYesejnPRq5xemr7kwTmB5j/+mQ8L8Ev:oDk0rhFTXuQegnPyecgw6B5D+mZL82
Score

8^/10

persistence spyware stealer
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Remote System Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer