070b7218404b7b048845c37cf7e1c664f0aa16c5fb88aa7c70814663d1e5d9f5 | Triage

Sharing

General

Target

070b7218404b7b048845c37cf7e1c664f0aa16c5fb88aa7c70814663d1e5d9f5
Size

924KB
Sample

221124-jjbddacc8z
MD5

fdb87e0641811951b636754f55a187b4
SHA1

3df542cc57a98f53420ef84a66eb58120fb63dfa
SHA256

070b7218404b7b048845c37cf7e1c664f0aa16c5fb88aa7c70814663d1e5d9f5
SHA512

0cdb758faa877653d772f0e68daddbb042284e6fa42d44fb52805764ca7d2f02214561e2fbe55d6fd53968bd6f45048353e3cdcb123e15b7dee7e130452e9735
SSDEEP

24576:h1OYdaO4fC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX6:h1OsRMN6wdBh5N5Z4E8PuX6

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  070b7218404b7b048845c37cf7e1c664f0aa16c5fb88aa7c70814663d1e5d9f5
- Size
  
  924KB
- MD5
  
  fdb87e0641811951b636754f55a187b4
- SHA1
  
  3df542cc57a98f53420ef84a66eb58120fb63dfa
- SHA256
  
  070b7218404b7b048845c37cf7e1c664f0aa16c5fb88aa7c70814663d1e5d9f5
- SHA512
  
  0cdb758faa877653d772f0e68daddbb042284e6fa42d44fb52805764ca7d2f02214561e2fbe55d6fd53968bd6f45048353e3cdcb123e15b7dee7e130452e9735
- SSDEEP
  
  24576:h1OYdaO4fC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX6:h1OsRMN6wdBh5N5Z4E8PuX6
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer