ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2 | Triage

Sharing

General

Target

ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2
Size

625KB
Sample

221125-lgy3rsgb72
MD5

75758ea1bddf91e249edf6387adbd794
SHA1

06c1256c9d5f8305a8b34580a4963b4fdf86377c
SHA256

ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2
SHA512

f53a9f02a46c73fb3d775e8fb73ae135097849e95448100cd87fbfeda91a4f8409231f8ee096512eedf3a6e49ed212b1a29eb493cd487b508fc20ff6d7acce1e
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2
- Size
  
  625KB
- MD5
  
  75758ea1bddf91e249edf6387adbd794
- SHA1
  
  06c1256c9d5f8305a8b34580a4963b4fdf86377c
- SHA256
  
  ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2
- SHA512
  
  f53a9f02a46c73fb3d775e8fb73ae135097849e95448100cd87fbfeda91a4f8409231f8ee096512eedf3a6e49ed212b1a29eb493cd487b508fc20ff6d7acce1e
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

8^/10

persistence spyware stealer
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer