c23a85e913d57c724af804dfed39e3b57a5fa5a217a05c08975d0e723e0dafea | Triage

Sharing

General

Target

c23a85e913d57c724af804dfed39e3b57a5fa5a217a05c08975d0e723e0dafea
Size

931KB
Sample

221124-ye8weahf8t
MD5

09457051262edf4ee2ba5b6101486dd7
SHA1

987f735e790d6520aed04e3131aacb4920415c0c
SHA256

c23a85e913d57c724af804dfed39e3b57a5fa5a217a05c08975d0e723e0dafea
SHA512

282b4587400f9ba1c39431e2afaed295852db81e6a82c0f98a80491942385ceec3f4f1745fea351b57ebcd59f49c3f855d98da4c32dfe9656b00e6dd13e6354d
SSDEEP

24576:h1OYdaOvCZ/iWCvu/2sWsJA/jlt+DHhsh:h1OsVCpYO/dJJDHhsh

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c23a85e913d57c724af804dfed39e3b57a5fa5a217a05c08975d0e723e0dafea
- Size
  
  931KB
- MD5
  
  09457051262edf4ee2ba5b6101486dd7
- SHA1
  
  987f735e790d6520aed04e3131aacb4920415c0c
- SHA256
  
  c23a85e913d57c724af804dfed39e3b57a5fa5a217a05c08975d0e723e0dafea
- SHA512
  
  282b4587400f9ba1c39431e2afaed295852db81e6a82c0f98a80491942385ceec3f4f1745fea351b57ebcd59f49c3f855d98da4c32dfe9656b00e6dd13e6354d
- SSDEEP
  
  24576:h1OYdaOvCZ/iWCvu/2sWsJA/jlt+DHhsh:h1OsVCpYO/dJJDHhsh
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2