f3f4e5bf560c34dbc50a84450c323f95bb39e0e209a8a49031fd2f5892c37169 | Triage

Sharing

General

Target

f3f4e5bf560c34dbc50a84450c323f95bb39e0e209a8a49031fd2f5892c37169
Size

815KB
Sample

221123-pxqm4sce23
MD5

f33ec9f931537dc8b123b12394e5e6e8
SHA1

821c6d058caca283b7708f52136c9eb791412c9a
SHA256

f3f4e5bf560c34dbc50a84450c323f95bb39e0e209a8a49031fd2f5892c37169
SHA512

d25f56c61dccd1488ea6758f3c6ce5632b66519c54519ce54068e15d91761ef94d327789128d3ea1dc505d6e899d100b331c61ba4cdd5fcbca61666c07a935a0
SSDEEP

12288:DdjMkNhtMqymUE4tIV0dj5uDfoRdOQHM/yATKOLNx1Oyp68DBpY3h8iRLPK2j7vl:DdjMkNhJlV0djY0HSxDndDBy3Se1h1

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  f3f4e5bf560c34dbc50a84450c323f95bb39e0e209a8a49031fd2f5892c37169
- Size
  
  815KB
- MD5
  
  f33ec9f931537dc8b123b12394e5e6e8
- SHA1
  
  821c6d058caca283b7708f52136c9eb791412c9a
- SHA256
  
  f3f4e5bf560c34dbc50a84450c323f95bb39e0e209a8a49031fd2f5892c37169
- SHA512
  
  d25f56c61dccd1488ea6758f3c6ce5632b66519c54519ce54068e15d91761ef94d327789128d3ea1dc505d6e899d100b331c61ba4cdd5fcbca61666c07a935a0
- SSDEEP
  
  12288:DdjMkNhtMqymUE4tIV0dj5uDfoRdOQHM/yATKOLNx1Oyp68DBpY3h8iRLPK2j7vl:DdjMkNhJlV0djY0HSxDndDBy3Se1h1
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer