43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2
Size

1.5MB
Sample

221030-zvah8abegk
MD5

91918fda0133e1608dff8c03c2821280
SHA1

6ab2a29c7b108476bb534d3426bca8332b385428
SHA256

43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2
SHA512

828d0f73fe5c8f61c16c4c0f471a57c24198c8552b221bc9d1e9d3f502bdc840a15ee358023a632e55d47986437fd83ebc2be5fadd136faa746f37c4e3be7824
SSDEEP

24576:2WhImrf1tWxLpe3xvUEyGXCUdkbYvGl1J84snQonsB0ys4GpdpMbMu:zhI29sLpe36QXN6GGlLnqKJeu

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2
- Size
  
  1.5MB
- MD5
  
  91918fda0133e1608dff8c03c2821280
- SHA1
  
  6ab2a29c7b108476bb534d3426bca8332b385428
- SHA256
  
  43532bd9be7eaf51dd7283026b31ea4e8458fd4ace788400f8db5c69cf7c44c2
- SHA512
  
  828d0f73fe5c8f61c16c4c0f471a57c24198c8552b221bc9d1e9d3f502bdc840a15ee358023a632e55d47986437fd83ebc2be5fadd136faa746f37c4e3be7824
- SSDEEP
  
  24576:2WhImrf1tWxLpe3xvUEyGXCUdkbYvGl1J84snQonsB0ys4GpdpMbMu:zhI29sLpe36QXN6GGlLnqKJeu
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer