90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe | Triage

Sharing

General

Target

90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe
Size

973KB
Sample

221125-k87zbabb3t
MD5

c66f140df79c28dbcb79511467400d7e
SHA1

5ef2b80388644c8c3e7cf4a30190531a0398ddfc
SHA256

90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe
SHA512

3567e045f0258a0698dceeebfa3be11c7ced260d3e5c393b62a761ea0d7833ce291cc1827672627b26e096866bc78b48667d53db6d268118dc8fcfb4302c9ed2
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe
- Size
  
  973KB
- MD5
  
  c66f140df79c28dbcb79511467400d7e
- SHA1
  
  5ef2b80388644c8c3e7cf4a30190531a0398ddfc
- SHA256
  
  90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe
- SHA512
  
  3567e045f0258a0698dceeebfa3be11c7ced260d3e5c393b62a761ea0d7833ce291cc1827672627b26e096866bc78b48667d53db6d268118dc8fcfb4302c9ed2
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer