5f6ec633b49198f4412739a20be168950fc8c01c1fda868437feba2eb5d52901 | Triage

Sharing

General

Target

5f6ec633b49198f4412739a20be168950fc8c01c1fda868437feba2eb5d52901
Size

823KB
Sample

221107-p1v21aafan
MD5

0a49edd70c73cbbb2c4ec47f26606666
SHA1

b811184fc970613f1c93016ee0c60b7f40e943ef
SHA256

5f6ec633b49198f4412739a20be168950fc8c01c1fda868437feba2eb5d52901
SHA512

cc2d78bc8187824b07dc14e5ea9fc1a99a452c142a13ca195ea1505e6f010fb558b4e7efab8deb07e94d5e845f8fdae6ea5ffe0531a6290e87dbaedefe77ec19
SSDEEP

24576:fgQnlX9y+JFIGEE9F0Q8PMbck4l4DCpn6cyTq:4mlMkNf5Akfzu

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  5f6ec633b49198f4412739a20be168950fc8c01c1fda868437feba2eb5d52901
- Size
  
  823KB
- MD5
  
  0a49edd70c73cbbb2c4ec47f26606666
- SHA1
  
  b811184fc970613f1c93016ee0c60b7f40e943ef
- SHA256
  
  5f6ec633b49198f4412739a20be168950fc8c01c1fda868437feba2eb5d52901
- SHA512
  
  cc2d78bc8187824b07dc14e5ea9fc1a99a452c142a13ca195ea1505e6f010fb558b4e7efab8deb07e94d5e845f8fdae6ea5ffe0531a6290e87dbaedefe77ec19
- SSDEEP
  
  24576:fgQnlX9y+JFIGEE9F0Q8PMbck4l4DCpn6cyTq:4mlMkNf5Akfzu
Score

8^/10

discovery persistence spyware stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2