8bffb424afe3eb52b8b7d8c8e040e807e25c8286912f1e32e911db72e29e51c9 | Triage

Sharing

General

Target

8bffb424afe3eb52b8b7d8c8e040e807e25c8286912f1e32e911db72e29e51c9
Size

243KB
Sample

221121-3gspeseh6t
MD5

2548a7d87f00401aaa92f9985a9fce24
SHA1

31238e5d8720db1948a8858741485699f3faa870
SHA256

8bffb424afe3eb52b8b7d8c8e040e807e25c8286912f1e32e911db72e29e51c9
SHA512

3356c6802e23cc0850e3faefe0ba516789500f275e0cde05534f30dd53d27bc557c6816f65c4adc8529a38c31054c4552a09145a26d812223ead896e37006da4
SSDEEP

6144:1QqWMOnO9XDHdrmlopP4hc1HGr+mI7eR/LPZo/mSNywkX:SHYLolwPoc1HvxCRrZo/94X

Score

9^/10

evasion spyware stealer

Malware Config

Targets

- Target
  
  8bffb424afe3eb52b8b7d8c8e040e807e25c8286912f1e32e911db72e29e51c9
- Size
  
  243KB
- MD5
  
  2548a7d87f00401aaa92f9985a9fce24
- SHA1
  
  31238e5d8720db1948a8858741485699f3faa870
- SHA256
  
  8bffb424afe3eb52b8b7d8c8e040e807e25c8286912f1e32e911db72e29e51c9
- SHA512
  
  3356c6802e23cc0850e3faefe0ba516789500f275e0cde05534f30dd53d27bc557c6816f65c4adc8529a38c31054c4552a09145a26d812223ead896e37006da4
- SSDEEP
  
  6144:1QqWMOnO9XDHdrmlopP4hc1HGr+mI7eR/LPZo/mSNywkX:SHYLolwPoc1HvxCRrZo/94X
Score

9^/10

evasion spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywarestealer

behavioral2

evasionspywarestealer