6fb902f6dc870833054b9696a67c8fd86570aacf954229aac2ba4b31fbfec7dc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6fb902f6dc870833054b9696a67c8fd86570aacf954229aac2ba4b31fbfec7dc
Size

398KB
Sample

221124-bezleacb21
MD5

4b86a123bf8f6fc62855178d6dd7f9f0
SHA1

d7abc3b688d2f54b5d075a8bb2b5499ec0eb1324
SHA256

6fb902f6dc870833054b9696a67c8fd86570aacf954229aac2ba4b31fbfec7dc
SHA512

c2ed51c2bee6de30d7384e6c86093f16374c6d928c4cc95c5a38bab0aa8437d0d75e694fd1fc7bbba6d5900c7a7f699faae822d46c6096188ec0d3bbbfadb339
SSDEEP

12288:zXCNi9Bvwetfd7gJgTjKcuG8md897IWaF:2WLpgOTjKcuGCaF

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  6fb902f6dc870833054b9696a67c8fd86570aacf954229aac2ba4b31fbfec7dc
- Size
  
  398KB
- MD5
  
  4b86a123bf8f6fc62855178d6dd7f9f0
- SHA1
  
  d7abc3b688d2f54b5d075a8bb2b5499ec0eb1324
- SHA256
  
  6fb902f6dc870833054b9696a67c8fd86570aacf954229aac2ba4b31fbfec7dc
- SHA512
  
  c2ed51c2bee6de30d7384e6c86093f16374c6d928c4cc95c5a38bab0aa8437d0d75e694fd1fc7bbba6d5900c7a7f699faae822d46c6096188ec0d3bbbfadb339
- SSDEEP
  
  12288:zXCNi9Bvwetfd7gJgTjKcuG8md897IWaF:2WLpgOTjKcuGCaF
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer