50c89c037db56719b2ff40ffa5903325fbf7a049723f853f5e14489613def2be | Triage

Sharing

General

Target

50c89c037db56719b2ff40ffa5903325fbf7a049723f853f5e14489613def2be
Size

77KB
Sample

221123-vr39xahg96
MD5

cc702ebacc4eeed925f1ecc474df2ad7
SHA1

e2ee65a0316a0f0556fb77a6365db295b13cf781
SHA256

50c89c037db56719b2ff40ffa5903325fbf7a049723f853f5e14489613def2be
SHA512

d2c3aaaf8650aae1eb953a4563e81fc4e4f8b3a149e8406ed05f38a3329c5c4dd39ae6f3d26f2860681643cd808f5998963e084badbca200a389e9af1a3c983a
SSDEEP

1536:67zHqOqNvIQZHIfHV9Z7gDKm+8SZ0LgK07B:675GtIfHjSSZ0LZ07B

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  50c89c037db56719b2ff40ffa5903325fbf7a049723f853f5e14489613def2be
- Size
  
  77KB
- MD5
  
  cc702ebacc4eeed925f1ecc474df2ad7
- SHA1
  
  e2ee65a0316a0f0556fb77a6365db295b13cf781
- SHA256
  
  50c89c037db56719b2ff40ffa5903325fbf7a049723f853f5e14489613def2be
- SHA512
  
  d2c3aaaf8650aae1eb953a4563e81fc4e4f8b3a149e8406ed05f38a3329c5c4dd39ae6f3d26f2860681643cd808f5998963e084badbca200a389e9af1a3c983a
- SSDEEP
  
  1536:67zHqOqNvIQZHIfHV9Z7gDKm+8SZ0LgK07B:675GtIfHjSSZ0LZ07B
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops Chrome extension
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer