94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11 | Triage

Sharing

General

Target

94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11
Size

931KB
Sample

221124-j9ztnaea9z
MD5

6519f6be4bd4ececa26245b16d2f6ec2
SHA1

4d7d280b0b80169ffd5a45086d8a5f21a72be7f3
SHA256

94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11
SHA512

ec824e5d8c52561d3655eaa0b3b68a3c8e04498375a91de575597aa4402850e8e518f656d4da07d9bb739934f145ee14294d320ce3c01ec44e2aa0572bb4ff2d
SSDEEP

24576:h1OYdaOoMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfS:h1OsOMWyUQ+GUVFIcHPvpfS

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11
- Size
  
  931KB
- MD5
  
  6519f6be4bd4ececa26245b16d2f6ec2
- SHA1
  
  4d7d280b0b80169ffd5a45086d8a5f21a72be7f3
- SHA256
  
  94f8a86d2df0e39ee0f4347a4002af4b71dce606db9c3a0a487cbb89d7159d11
- SHA512
  
  ec824e5d8c52561d3655eaa0b3b68a3c8e04498375a91de575597aa4402850e8e518f656d4da07d9bb739934f145ee14294d320ce3c01ec44e2aa0572bb4ff2d
- SSDEEP
  
  24576:h1OYdaOoMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfS:h1OsOMWyUQ+GUVFIcHPvpfS
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2