564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90 | Triage

Sharing

General

Target

564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90
Size

993KB
Sample

221123-vpylmshf45
MD5

d56eed9e5057862b80e329d0ec66ef53
SHA1

1564930ac078526def8c8e14370f317cd2f250e4
SHA256

564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90
SHA512

6cc8b5c35f4c675429f8ef00f08d4ddd4bd70ed4f2a46faff96e9d64695e76e715f0deb6cd57b040356a1877f0c4afb027961d62d5a8d11b5b76693ba1769f70
SSDEEP

24576:OHO1tcLf/EciX/TTq3yYHtRIM73bZsih:XGLfAqiEh

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90
- Size
  
  993KB
- MD5
  
  d56eed9e5057862b80e329d0ec66ef53
- SHA1
  
  1564930ac078526def8c8e14370f317cd2f250e4
- SHA256
  
  564af6d0de39f3cf05d56c0cf068dea257c7e3db91273f49b8d0723ad44a7b90
- SHA512
  
  6cc8b5c35f4c675429f8ef00f08d4ddd4bd70ed4f2a46faff96e9d64695e76e715f0deb6cd57b040356a1877f0c4afb027961d62d5a8d11b5b76693ba1769f70
- SSDEEP
  
  24576:OHO1tcLf/EciX/TTq3yYHtRIM73bZsih:XGLfAqiEh
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer