fee9e097c919d8b105f4bc5163a9a0840930543b3bea7a3628901ed3c8f12f00 | Triage

Sharing

General

Target

fee9e097c919d8b105f4bc5163a9a0840930543b3bea7a3628901ed3c8f12f00
Size

1.3MB
Sample

221123-s3p6bafh91
MD5

5623e0914be6d4385314d74a973362d6
SHA1

9adf0b779c913eefdfb8114ef25f955b2aaa7389
SHA256

fee9e097c919d8b105f4bc5163a9a0840930543b3bea7a3628901ed3c8f12f00
SHA512

65e2125bf79d5d78ca9443a04ddcc23ae9829a9d374f1215897a0da8e096e8e229acf040cd0223ad4ea4358e6673c956f27493bad04650bb1c471ec809643cbf
SSDEEP

24576:/31Bj9B9SnMX3jeK4/LdKjyNtlSQzGVgTlJfPBPwgUhO8bTONXq7tY/N8BQtzR:rJvuLk2NtlCqbNWx4X5/NbF

Score

9^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  fee9e097c919d8b105f4bc5163a9a0840930543b3bea7a3628901ed3c8f12f00
- Size
  
  1.3MB
- MD5
  
  5623e0914be6d4385314d74a973362d6
- SHA1
  
  9adf0b779c913eefdfb8114ef25f955b2aaa7389
- SHA256
  
  fee9e097c919d8b105f4bc5163a9a0840930543b3bea7a3628901ed3c8f12f00
- SHA512
  
  65e2125bf79d5d78ca9443a04ddcc23ae9829a9d374f1215897a0da8e096e8e229acf040cd0223ad4ea4358e6673c956f27493bad04650bb1c471ec809643cbf
- SSDEEP
  
  24576:/31Bj9B9SnMX3jeK4/LdKjyNtlSQzGVgTlJfPBPwgUhO8bTONXq7tY/N8BQtzR:rJvuLk2NtlCqbNWx4X5/NbF
Score

9^/10

discovery evasion persistence spyware stealer
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Software Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasionpersistencespywarestealer