8988ee4cebf1f1ccef196d2c5ffc1ab2dd2cd81efee45567dadd54f3fb3acfd6 | Triage

Sharing

General

Target

8988ee4cebf1f1ccef196d2c5ffc1ab2dd2cd81efee45567dadd54f3fb3acfd6
Size

720KB
Sample

221125-laz2gsbc3z
MD5

76d4d6064bf443f45b37bc2a3d7fe680
SHA1

809eb5b3913cb071848033d7d7dc4408bf36189e
SHA256

8988ee4cebf1f1ccef196d2c5ffc1ab2dd2cd81efee45567dadd54f3fb3acfd6
SHA512

554e737ae5935c1a4077def48e29f6dc2f98da08f0802c134c6ca34cbe3ec4e2e3e17b50bcd83cd206577615cbc139b580e2ebf7d80d741182863b546528b69a
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  8988ee4cebf1f1ccef196d2c5ffc1ab2dd2cd81efee45567dadd54f3fb3acfd6
- Size
  
  720KB
- MD5
  
  76d4d6064bf443f45b37bc2a3d7fe680
- SHA1
  
  809eb5b3913cb071848033d7d7dc4408bf36189e
- SHA256
  
  8988ee4cebf1f1ccef196d2c5ffc1ab2dd2cd81efee45567dadd54f3fb3acfd6
- SHA512
  
  554e737ae5935c1a4077def48e29f6dc2f98da08f0802c134c6ca34cbe3ec4e2e3e17b50bcd83cd206577615cbc139b580e2ebf7d80d741182863b546528b69a
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer