c4905216081d9113e497548a67c77d7cbf87301e28d958f04b406a42e225f059 | Triage

Sharing

General

Target

c4905216081d9113e497548a67c77d7cbf87301e28d958f04b406a42e225f059
Size

931KB
Sample

221124-ya2xasec73
MD5

f18889faf69e4e68374772ed126dcc39
SHA1

7adf962d6c113fcb76a17d7d39842f4cdbb1d49f
SHA256

c4905216081d9113e497548a67c77d7cbf87301e28d958f04b406a42e225f059
SHA512

2dc98aad00f402d60350d11b234dc8ceae53f0a4c809a87b5d3839e5433b4206e7de9d5ccaf5ab12a8d5d4bfba30ab4345793b517f541edf5800acb04148bdee
SSDEEP

24576:h1OYdaOaCZ/iWCvu/2sWsJA/jlt+DHhs9:h1OssCpYO/dJJDHhs9

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c4905216081d9113e497548a67c77d7cbf87301e28d958f04b406a42e225f059
- Size
  
  931KB
- MD5
  
  f18889faf69e4e68374772ed126dcc39
- SHA1
  
  7adf962d6c113fcb76a17d7d39842f4cdbb1d49f
- SHA256
  
  c4905216081d9113e497548a67c77d7cbf87301e28d958f04b406a42e225f059
- SHA512
  
  2dc98aad00f402d60350d11b234dc8ceae53f0a4c809a87b5d3839e5433b4206e7de9d5ccaf5ab12a8d5d4bfba30ab4345793b517f541edf5800acb04148bdee
- SSDEEP
  
  24576:h1OYdaOaCZ/iWCvu/2sWsJA/jlt+DHhs9:h1OssCpYO/dJJDHhs9
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer