29f8a9d8884e1aa38f1fe2ede25da6287bfb24586dcb35fd2679e90ab12feef0 | Triage

Sharing

General

Target

29f8a9d8884e1aa38f1fe2ede25da6287bfb24586dcb35fd2679e90ab12feef0
Size

987KB
Sample

221125-kep7eahc5t
MD5

ab160cbd5ba23bf8bdda57fa0f2b1650
SHA1

3ad1f672f16d54af418cf731eb702528f083d823
SHA256

29f8a9d8884e1aa38f1fe2ede25da6287bfb24586dcb35fd2679e90ab12feef0
SHA512

fbf19e5da3d22989ebe764a1683fb69fb0999c3b9cf5b44b6794def95d93d4777c9ea1c22f00ee3071f360ae0afeab4c3d62cc04c8dc895c4dc75102eb588e48
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  29f8a9d8884e1aa38f1fe2ede25da6287bfb24586dcb35fd2679e90ab12feef0
- Size
  
  987KB
- MD5
  
  ab160cbd5ba23bf8bdda57fa0f2b1650
- SHA1
  
  3ad1f672f16d54af418cf731eb702528f083d823
- SHA256
  
  29f8a9d8884e1aa38f1fe2ede25da6287bfb24586dcb35fd2679e90ab12feef0
- SHA512
  
  fbf19e5da3d22989ebe764a1683fb69fb0999c3b9cf5b44b6794def95d93d4777c9ea1c22f00ee3071f360ae0afeab4c3d62cc04c8dc895c4dc75102eb588e48
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

8^/10

persistence spyware stealer
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer