ab06f96ea33cd450a40c5babb204064ea5b21397713fb705ecedb728ffd7b0bf | Triage

Sharing

General

Target

ab06f96ea33cd450a40c5babb204064ea5b21397713fb705ecedb728ffd7b0bf
Size

522KB
Sample

221125-kj4klaeb26
MD5

4abdf9379ca35522f5d426840aee12cb
SHA1

8a82210b16774ea2e974b003faa23473cdb26a2b
SHA256

ab06f96ea33cd450a40c5babb204064ea5b21397713fb705ecedb728ffd7b0bf
SHA512

46e45982dc4aa5bd9107a076d24f49d0451214a49eaf6b92f42bbc4b24ad6ab68a07a0b45e19fa765dba7631b14892f028cc20d0992637ff54c58046c9815eb6
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  ab06f96ea33cd450a40c5babb204064ea5b21397713fb705ecedb728ffd7b0bf
- Size
  
  522KB
- MD5
  
  4abdf9379ca35522f5d426840aee12cb
- SHA1
  
  8a82210b16774ea2e974b003faa23473cdb26a2b
- SHA256
  
  ab06f96ea33cd450a40c5babb204064ea5b21397713fb705ecedb728ffd7b0bf
- SHA512
  
  46e45982dc4aa5bd9107a076d24f49d0451214a49eaf6b92f42bbc4b24ad6ab68a07a0b45e19fa765dba7631b14892f028cc20d0992637ff54c58046c9815eb6
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer