abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c | Triage

Sharing

General

Target

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c
Size

274KB
Sample

221124-d3jafahf21
MD5

545474e5e27aceaf673b1ae0e72bec43
SHA1

da2ee3a1fb37e3c7906b49f9816272d0020bbf7f
SHA256

abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c
SHA512

10a3188e1f93d43caacdbb6160e26ae1898b099da9b7edde4443637d8cd6b43235cae2b68b5732f7ced1bc098e51508b4aeb914a4e684e7d6b1892fd4f581f43
SSDEEP

6144:Iy9v17kwzVKndyPJMnDEXZBWqNpPB5leWe92TbpYViUbE+6kQL:597kAKndybnWqNpJ7e6TdiLB6kQ

Score

9^/10

ransomware spyware stealer

Malware Config

Targets

- Target
  
  abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c
- Size
  
  274KB
- MD5
  
  545474e5e27aceaf673b1ae0e72bec43
- SHA1
  
  da2ee3a1fb37e3c7906b49f9816272d0020bbf7f
- SHA256
  
  abfad32a54931bced34394373381e2d5e2565a30648daca1a2462ee25caa3a3c
- SHA512
  
  10a3188e1f93d43caacdbb6160e26ae1898b099da9b7edde4443637d8cd6b43235cae2b68b5732f7ced1bc098e51508b4aeb914a4e684e7d6b1892fd4f581f43
- SSDEEP
  
  6144:Iy9v17kwzVKndyPJMnDEXZBWqNpPB5leWe92TbpYViUbE+6kQL:597kAKndybnWqNpJ7e6TdiLB6kQ
Score

9^/10

ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarespywarestealer

behavioral2

ransomwarespywarestealer