8e2d8b0900d3842e9702bd77fc245b5fa899abec01f23fb04f4519f1c5245cc4 | Triage

Sharing

General

Target

8e2d8b0900d3842e9702bd77fc245b5fa899abec01f23fb04f4519f1c5245cc4
Size

10.3MB
Sample

221125-lkq7bsbh3t
MD5

69e1f0e22301689ea77819d76df44933
SHA1

9e8cc9f959ebc4ad59cae96991c360c7e821e00c
SHA256

8e2d8b0900d3842e9702bd77fc245b5fa899abec01f23fb04f4519f1c5245cc4
SHA512

bc8fa76f57365a93f3b2e3a3886b58bc0c5aa239cd40a77b736c56cf4c6a7ada5584138d5bbe795689a17f2ccbf2eb0566c124b8943a268de31d29abbf0a3abc
SSDEEP

196608:4JUce6Y6hupHWpWoP1H2ZwG93wXlttbYPvbJQlHIoNpETvN8Cij0yvnpo61pYqP:4JUAYAuRQP1gwrX3kJQlJETCbPVQ

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  8e2d8b0900d3842e9702bd77fc245b5fa899abec01f23fb04f4519f1c5245cc4
- Size
  
  10.3MB
- MD5
  
  69e1f0e22301689ea77819d76df44933
- SHA1
  
  9e8cc9f959ebc4ad59cae96991c360c7e821e00c
- SHA256
  
  8e2d8b0900d3842e9702bd77fc245b5fa899abec01f23fb04f4519f1c5245cc4
- SHA512
  
  bc8fa76f57365a93f3b2e3a3886b58bc0c5aa239cd40a77b736c56cf4c6a7ada5584138d5bbe795689a17f2ccbf2eb0566c124b8943a268de31d29abbf0a3abc
- SSDEEP
  
  196608:4JUce6Y6hupHWpWoP1H2ZwG93wXlttbYPvbJQlHIoNpETvN8Cij0yvnpo61pYqP:4JUAYAuRQP1gwrX3kJQlJETCbPVQ
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2