54ceb8d4e40cacbbff06ea7acdf7c9b150b24a7c50b3503450f9fbd6a33ae9a9 | Triage

Sharing

General

Target

54ceb8d4e40cacbbff06ea7acdf7c9b150b24a7c50b3503450f9fbd6a33ae9a9
Size

836KB
Sample

221125-kyaaaseh84
MD5

424450b06c31378400ec7df8d23187d8
SHA1

9b444b81df0b697305e320da20092785ec305802
SHA256

54ceb8d4e40cacbbff06ea7acdf7c9b150b24a7c50b3503450f9fbd6a33ae9a9
SHA512

34d40748c7ed0acf169a8a83167353dc56cbb0a1e25348a4716946ff4317d2c9477f030d871e13101d12398f8ee7f1f419f313894dd26c981b544dd397b299f4
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  54ceb8d4e40cacbbff06ea7acdf7c9b150b24a7c50b3503450f9fbd6a33ae9a9
- Size
  
  836KB
- MD5
  
  424450b06c31378400ec7df8d23187d8
- SHA1
  
  9b444b81df0b697305e320da20092785ec305802
- SHA256
  
  54ceb8d4e40cacbbff06ea7acdf7c9b150b24a7c50b3503450f9fbd6a33ae9a9
- SHA512
  
  34d40748c7ed0acf169a8a83167353dc56cbb0a1e25348a4716946ff4317d2c9477f030d871e13101d12398f8ee7f1f419f313894dd26c981b544dd397b299f4
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer