be14584dd7b2baad6c48d9d8a8dd7af1157d29fbb3ea10aaa307a9dfd50827f1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be14584dd7b2baad6c48d9d8a8dd7af1157d29fbb3ea10aaa307a9dfd50827f1
Size

48KB
Sample

221029-tyrzsaeca6
MD5

5cb7266542e52ee0cc91eeb006fa7a50
SHA1

9af91c3336f3a8edecdfeff9055df8b232cd6fcd
SHA256

be14584dd7b2baad6c48d9d8a8dd7af1157d29fbb3ea10aaa307a9dfd50827f1
SHA512

e7caf5719c4edea2d54583f070f52bdde26ac2dfffb74ee61a4ec35411fc5bbcd25f37648354b4508b48d837dc5b2db933cf31f933cd3b982a4b83c5e9c75620
SSDEEP

768:5KtElOIEvzMXqtwp/lDTJg/MFksCRsd2o1spc/jXhnzgohBDYMUrOOKvL3eIbq:5KtaYzMXqtGN/Csnj/jXhzgo3LTTHq

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  be14584dd7b2baad6c48d9d8a8dd7af1157d29fbb3ea10aaa307a9dfd50827f1
- Size
  
  48KB
- MD5
  
  5cb7266542e52ee0cc91eeb006fa7a50
- SHA1
  
  9af91c3336f3a8edecdfeff9055df8b232cd6fcd
- SHA256
  
  be14584dd7b2baad6c48d9d8a8dd7af1157d29fbb3ea10aaa307a9dfd50827f1
- SHA512
  
  e7caf5719c4edea2d54583f070f52bdde26ac2dfffb74ee61a4ec35411fc5bbcd25f37648354b4508b48d837dc5b2db933cf31f933cd3b982a4b83c5e9c75620
- SSDEEP
  
  768:5KtElOIEvzMXqtwp/lDTJg/MFksCRsd2o1spc/jXhnzgohBDYMUrOOKvL3eIbq:5KtaYzMXqtGN/Csnj/jXhzgo3LTTHq
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2