c01f4f7eb376e0cae7a0e55ea4cf80b02c900314625aaf41fbfe7644d310df51 | Triage

Sharing

General

Target

c01f4f7eb376e0cae7a0e55ea4cf80b02c900314625aaf41fbfe7644d310df51
Size

931KB
Sample

221124-yj8ffahh91
MD5

41056b3ae45311c916babef65c656b91
SHA1

2dde454c4daceb0299d94136065727ed7a9e57e9
SHA256

c01f4f7eb376e0cae7a0e55ea4cf80b02c900314625aaf41fbfe7644d310df51
SHA512

287cd1cf98292ff0baf4c596bbcccd8a314e7fb7faeada25d24a7824a50ece3a00be89ac6cbd1986bb19d0770537e6f89859980c1c4a387cf083301e224e858e
SSDEEP

24576:h1OYdaO1CZ/iWCvu/2sWsJA/jlt+DHhsU:h1OsrCpYO/dJJDHhsU

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c01f4f7eb376e0cae7a0e55ea4cf80b02c900314625aaf41fbfe7644d310df51
- Size
  
  931KB
- MD5
  
  41056b3ae45311c916babef65c656b91
- SHA1
  
  2dde454c4daceb0299d94136065727ed7a9e57e9
- SHA256
  
  c01f4f7eb376e0cae7a0e55ea4cf80b02c900314625aaf41fbfe7644d310df51
- SHA512
  
  287cd1cf98292ff0baf4c596bbcccd8a314e7fb7faeada25d24a7824a50ece3a00be89ac6cbd1986bb19d0770537e6f89859980c1c4a387cf083301e224e858e
- SSDEEP
  
  24576:h1OYdaO1CZ/iWCvu/2sWsJA/jlt+DHhsU:h1OsrCpYO/dJJDHhsU
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer