4b1ef993a875dcb7bcf87114b2f36967df64da2483434ca8de929f3dca93374b | Triage

Sharing

General

Target

4b1ef993a875dcb7bcf87114b2f36967df64da2483434ca8de929f3dca93374b
Size

919KB
Sample

221125-ca85qadc25
MD5

8408a21bed8ef66e596dc927a63db75a
SHA1

3e492e4833a6f526feda3831565a2c52acb32a09
SHA256

4b1ef993a875dcb7bcf87114b2f36967df64da2483434ca8de929f3dca93374b
SHA512

36834080de2546cbfab35398d5dcc6c79e7198a3761a9deba408032c9c70f2cd8e5d656480c495643a036705dca21a8a205d94fdee7288c54f20f620d4eb27e1
SSDEEP

24576:h1OYdaOfMtdHAqcdDVhYwiei7+EpFAh/kKM:h1Os+PHVmVhYwiLtKkKM

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  4b1ef993a875dcb7bcf87114b2f36967df64da2483434ca8de929f3dca93374b
- Size
  
  919KB
- MD5
  
  8408a21bed8ef66e596dc927a63db75a
- SHA1
  
  3e492e4833a6f526feda3831565a2c52acb32a09
- SHA256
  
  4b1ef993a875dcb7bcf87114b2f36967df64da2483434ca8de929f3dca93374b
- SHA512
  
  36834080de2546cbfab35398d5dcc6c79e7198a3761a9deba408032c9c70f2cd8e5d656480c495643a036705dca21a8a205d94fdee7288c54f20f620d4eb27e1
- SSDEEP
  
  24576:h1OYdaOfMtdHAqcdDVhYwiei7+EpFAh/kKM:h1Os+PHVmVhYwiLtKkKM
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer