8b6b3830c6bf20d4c91088304befffe9f6f0de67ee51217f323666c3876816a2 | Triage

Sharing

General

Target

8b6b3830c6bf20d4c91088304befffe9f6f0de67ee51217f323666c3876816a2
Size

931KB
Sample

221124-n285ksca28
MD5

6cf14e045d1a27f9d8a0252158e77686
SHA1

41d3ea4d54b86852afe04dcf357dcecba49d0d79
SHA256

8b6b3830c6bf20d4c91088304befffe9f6f0de67ee51217f323666c3876816a2
SHA512

12a437543b9fc805c64864b4f9dfda49806d756e163ab9226733271d155a9707bdb3985a915215e538accf708b0d3e0ec8af36b5e767e746f8b1cc309bbc5e33
SSDEEP

24576:h1OYdaONMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfL:h1OsDMWyUQ+GUVFIcHPvpfL

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  8b6b3830c6bf20d4c91088304befffe9f6f0de67ee51217f323666c3876816a2
- Size
  
  931KB
- MD5
  
  6cf14e045d1a27f9d8a0252158e77686
- SHA1
  
  41d3ea4d54b86852afe04dcf357dcecba49d0d79
- SHA256
  
  8b6b3830c6bf20d4c91088304befffe9f6f0de67ee51217f323666c3876816a2
- SHA512
  
  12a437543b9fc805c64864b4f9dfda49806d756e163ab9226733271d155a9707bdb3985a915215e538accf708b0d3e0ec8af36b5e767e746f8b1cc309bbc5e33
- SSDEEP
  
  24576:h1OYdaONMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfL:h1OsDMWyUQ+GUVFIcHPvpfL
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer