ebcd098c7de006f1afaa13c1dae508154afcd5a49c390f4cf6f8726ce5c810ba | Triage

Sharing

General

Target

ebcd098c7de006f1afaa13c1dae508154afcd5a49c390f4cf6f8726ce5c810ba
Size

809KB
Sample

221123-s5kzdadb25
MD5

abed620e802ea24d8d510cacbb994aa2
SHA1

15c93a92a5bca16b6835ab15136a509c56cfe3e1
SHA256

ebcd098c7de006f1afaa13c1dae508154afcd5a49c390f4cf6f8726ce5c810ba
SHA512

0a6248995e8cd07365d85da2f830d038a4e8c086f2dd115057f2a75607c71805bd9ad5fb2fbb46f38a99f11529f7daf833491e7ea0c543eb2c19c7318df3538c
SSDEEP

12288:oIobRtUQsUN2EiwyHKI6fnjI/QVCwfhHKtJJ2SMFQaT7RKZkT:XobvrHryxst3stmFN7gkT

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  ebcd098c7de006f1afaa13c1dae508154afcd5a49c390f4cf6f8726ce5c810ba
- Size
  
  809KB
- MD5
  
  abed620e802ea24d8d510cacbb994aa2
- SHA1
  
  15c93a92a5bca16b6835ab15136a509c56cfe3e1
- SHA256
  
  ebcd098c7de006f1afaa13c1dae508154afcd5a49c390f4cf6f8726ce5c810ba
- SHA512
  
  0a6248995e8cd07365d85da2f830d038a4e8c086f2dd115057f2a75607c71805bd9ad5fb2fbb46f38a99f11529f7daf833491e7ea0c543eb2c19c7318df3538c
- SSDEEP
  
  12288:oIobRtUQsUN2EiwyHKI6fnjI/QVCwfhHKtJJ2SMFQaT7RKZkT:XobvrHryxst3stmFN7gkT
Score

8^/10

discovery persistence spyware stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2