43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f | Triage

Sharing

General

Target

43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f
Size

790KB
Sample

221125-l6ytasdb9y
MD5

5578387f06f400080bde5edffb916326
SHA1

e7314811b374b84b703fbd13bfed773c2f122c48
SHA256

43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f
SHA512

3694a0a8315e854f9bea7fc4f2641087f8a84981b1b68e3088fa63ebec76c85e2df67d634af97796315b87c108a3f898ea73dba1116bf45f8d6403fd9c24a7fe
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f
- Size
  
  790KB
- MD5
  
  5578387f06f400080bde5edffb916326
- SHA1
  
  e7314811b374b84b703fbd13bfed773c2f122c48
- SHA256
  
  43c5742b0ffae5bcde3bbbaa22d050b4b480761f2c0ece900c7e3f8799d3758f
- SHA512
  
  3694a0a8315e854f9bea7fc4f2641087f8a84981b1b68e3088fa63ebec76c85e2df67d634af97796315b87c108a3f898ea73dba1116bf45f8d6403fd9c24a7fe
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer