fbc8ae02cbc93c51831e32d065ec0bb871c08cd9d4d828c5f0fc6c07633098cd | Triage

Sharing

General

Target

fbc8ae02cbc93c51831e32d065ec0bb871c08cd9d4d828c5f0fc6c07633098cd
Size

796KB
Sample

221123-ptsy3afd2y
MD5

ff3569bcce215c51f5651f536cc4af0e
SHA1

3e599df6213683bc78198b7d952d9094d776422b
SHA256

fbc8ae02cbc93c51831e32d065ec0bb871c08cd9d4d828c5f0fc6c07633098cd
SHA512

931a8800010acfd50d170001405d065dc44b1b6def565f6d8d76cfcc19eb4408af787f8315e0a3f1eba98186ea6723dd9d37c6976166f81de38d25c52a334ac2
SSDEEP

12288:MQzKLhn3xsfbIQxyeRBr3DB+N/suavLzok0fgLwVKA4NmnQhvprskaoE6:h4AzzoeRBrIN/slzKfg9A4Nz7r79

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  fbc8ae02cbc93c51831e32d065ec0bb871c08cd9d4d828c5f0fc6c07633098cd
- Size
  
  796KB
- MD5
  
  ff3569bcce215c51f5651f536cc4af0e
- SHA1
  
  3e599df6213683bc78198b7d952d9094d776422b
- SHA256
  
  fbc8ae02cbc93c51831e32d065ec0bb871c08cd9d4d828c5f0fc6c07633098cd
- SHA512
  
  931a8800010acfd50d170001405d065dc44b1b6def565f6d8d76cfcc19eb4408af787f8315e0a3f1eba98186ea6723dd9d37c6976166f81de38d25c52a334ac2
- SSDEEP
  
  12288:MQzKLhn3xsfbIQxyeRBr3DB+N/suavLzok0fgLwVKA4NmnQhvprskaoE6:h4AzzoeRBrIN/slzKfg9A4Nz7r79
Score

8^/10

discovery persistence spyware stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2