4eebe333ab5ddb5d2f9fae9c8793e9ea30380539c90ff64043fd1d0f58178658 | Triage

Sharing

General

Target

4eebe333ab5ddb5d2f9fae9c8793e9ea30380539c90ff64043fd1d0f58178658
Size

931KB
Sample

221124-j52gpadg61
MD5

02c5991dad51e6eb4ae41d7eb6fdd1bf
SHA1

af74ccff09ad6c5326c8e5122174f72292e47aef
SHA256

4eebe333ab5ddb5d2f9fae9c8793e9ea30380539c90ff64043fd1d0f58178658
SHA512

a12ad5e4459831df8a3cdb6e6278f1dce6977eac27801bdd27e34393ce72a11620fd252a5a506b717fc88d9ced44ae18e0cfc7bc023e47a8acd09f9ecb53a7aa
SSDEEP

24576:h1OYdaOHMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfD:h1OsNMWyUQ+GUVFIcHPvpfD

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  4eebe333ab5ddb5d2f9fae9c8793e9ea30380539c90ff64043fd1d0f58178658
- Size
  
  931KB
- MD5
  
  02c5991dad51e6eb4ae41d7eb6fdd1bf
- SHA1
  
  af74ccff09ad6c5326c8e5122174f72292e47aef
- SHA256
  
  4eebe333ab5ddb5d2f9fae9c8793e9ea30380539c90ff64043fd1d0f58178658
- SHA512
  
  a12ad5e4459831df8a3cdb6e6278f1dce6977eac27801bdd27e34393ce72a11620fd252a5a506b717fc88d9ced44ae18e0cfc7bc023e47a8acd09f9ecb53a7aa
- SSDEEP
  
  24576:h1OYdaOHMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfD:h1OsNMWyUQ+GUVFIcHPvpfD
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer