0cfb6227a6dc83404ea17128491c055781b216aff0dbf70647b437587e65a0ee | Triage

Sharing

General

Target

0cfb6227a6dc83404ea17128491c055781b216aff0dbf70647b437587e65a0ee
Size

931KB
Sample

221124-kbmxwaeb8v
MD5

b083fb7d5b129c80de9c2e64e738c26d
SHA1

34b9ba98e91374adb0fc35759a145f8482dbfd28
SHA256

0cfb6227a6dc83404ea17128491c055781b216aff0dbf70647b437587e65a0ee
SHA512

47130dde51676c6213d32fa3bf89153441e3d27ea5b4bf21139b2bf10786ebc0e0835610d817f3a0a310a99b6b3f4b28295a2e82faf6b31ac978f3df61d55b1d
SSDEEP

24576:h1OYdaODMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfr:h1Os1MWyUQ+GUVFIcHPvpfr

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  0cfb6227a6dc83404ea17128491c055781b216aff0dbf70647b437587e65a0ee
- Size
  
  931KB
- MD5
  
  b083fb7d5b129c80de9c2e64e738c26d
- SHA1
  
  34b9ba98e91374adb0fc35759a145f8482dbfd28
- SHA256
  
  0cfb6227a6dc83404ea17128491c055781b216aff0dbf70647b437587e65a0ee
- SHA512
  
  47130dde51676c6213d32fa3bf89153441e3d27ea5b4bf21139b2bf10786ebc0e0835610d817f3a0a310a99b6b3f4b28295a2e82faf6b31ac978f3df61d55b1d
- SSDEEP
  
  24576:h1OYdaODMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfr:h1Os1MWyUQ+GUVFIcHPvpfr
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer