c9734c03eb2622bee7a39731cab10e8c9ed161a3f8dc6719aa21417fcbbc1e4d | Triage

Sharing

General

Target

c9734c03eb2622bee7a39731cab10e8c9ed161a3f8dc6719aa21417fcbbc1e4d
Size

931KB
Sample

221124-x1tsyagg6t
MD5

d4873d330d1c4f2a08e425add8930cb6
SHA1

91bab4656b4088dea65d6a7de47579645573784d
SHA256

c9734c03eb2622bee7a39731cab10e8c9ed161a3f8dc6719aa21417fcbbc1e4d
SHA512

d8a0c7a767d7cf90f436c16a83547e8ffb88b21387ea42773aa08b45af7d12360b24dcf8a5956f8c500885b352adb49a576e8df41208b5e49d24136455f57a49
SSDEEP

24576:h1OYdaOYCZ/iWCvu/2sWsJA/jlt+DHhsS:h1OsuCpYO/dJJDHhsS

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c9734c03eb2622bee7a39731cab10e8c9ed161a3f8dc6719aa21417fcbbc1e4d
- Size
  
  931KB
- MD5
  
  d4873d330d1c4f2a08e425add8930cb6
- SHA1
  
  91bab4656b4088dea65d6a7de47579645573784d
- SHA256
  
  c9734c03eb2622bee7a39731cab10e8c9ed161a3f8dc6719aa21417fcbbc1e4d
- SHA512
  
  d8a0c7a767d7cf90f436c16a83547e8ffb88b21387ea42773aa08b45af7d12360b24dcf8a5956f8c500885b352adb49a576e8df41208b5e49d24136455f57a49
- SSDEEP
  
  24576:h1OYdaOYCZ/iWCvu/2sWsJA/jlt+DHhsS:h1OsuCpYO/dJJDHhsS
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2