60448f74827af1b2e85e1593c51bd0ff449e19dd3db6055e4ea778333565de51 | Triage

Sharing

General

Target

60448f74827af1b2e85e1593c51bd0ff449e19dd3db6055e4ea778333565de51
Size

60KB
Sample

221123-vlghyscc4t
MD5

1e09e010663bbd014f81439498831690
SHA1

fb2bd4db019e29629840b1b1e0f7cba8c78019f0
SHA256

60448f74827af1b2e85e1593c51bd0ff449e19dd3db6055e4ea778333565de51
SHA512

2c5914f615c3b0b5edaa8fc10e57162096ad443292716f1470a425f52c3680831dedf3a21c09c0c6fe1687aed232f2752d61c69b1cd7f75c86c206fec4cb51b0
SSDEEP

768:MTi6KchHpfzXAZfyooDmIBXmq2Upj9c6FVNTyHtQvKuzkE5nwGc:dHch5oIoA9c6vNTyaSuzkqw

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  60448f74827af1b2e85e1593c51bd0ff449e19dd3db6055e4ea778333565de51
- Size
  
  60KB
- MD5
  
  1e09e010663bbd014f81439498831690
- SHA1
  
  fb2bd4db019e29629840b1b1e0f7cba8c78019f0
- SHA256
  
  60448f74827af1b2e85e1593c51bd0ff449e19dd3db6055e4ea778333565de51
- SHA512
  
  2c5914f615c3b0b5edaa8fc10e57162096ad443292716f1470a425f52c3680831dedf3a21c09c0c6fe1687aed232f2752d61c69b1cd7f75c86c206fec4cb51b0
- SSDEEP
  
  768:MTi6KchHpfzXAZfyooDmIBXmq2Upj9c6FVNTyHtQvKuzkE5nwGc:dHch5oIoA9c6vNTyaSuzkqw
Score

8^/10

persistence spyware stealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer