c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe | Triage

Sharing

General

Target

c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe
Size

932KB
Sample

221124-yf49lsef55
MD5

930bf062fe79cc8b6b4ecbb070fa3107
SHA1

6d0b27dbd2935c6b3025062e70238b25c5643e6c
SHA256

c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe
SHA512

a8fdf562d68ebf24d8e7488cf384c330ef65bac3c47441ad23c14dbc8a6d7e414d2a9a7fca11326d11c41d6da42948a3bd45c23de909fe8006a30951f119a9b0
SSDEEP

24576:h1OYdaO5CZ/iWCvu/2sWsJA/jlt+DHhsL:h1OsfCpYO/dJJDHhsL

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe
- Size
  
  932KB
- MD5
  
  930bf062fe79cc8b6b4ecbb070fa3107
- SHA1
  
  6d0b27dbd2935c6b3025062e70238b25c5643e6c
- SHA256
  
  c1bbbe71690ab13a55a109b98ef84ff28af2dc7006f56f11c18076376923cdfe
- SHA512
  
  a8fdf562d68ebf24d8e7488cf384c330ef65bac3c47441ad23c14dbc8a6d7e414d2a9a7fca11326d11c41d6da42948a3bd45c23de909fe8006a30951f119a9b0
- SSDEEP
  
  24576:h1OYdaO5CZ/iWCvu/2sWsJA/jlt+DHhsL:h1OsfCpYO/dJJDHhsL
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2