42d2c24e492154147631ad8360d730bc01bfb8e1f057563b5ba96fac199c438f | Triage

Sharing

General

Target

42d2c24e492154147631ad8360d730bc01bfb8e1f057563b5ba96fac199c438f
Size

394KB
Sample

221125-lljtmsgd55
MD5

0c985eba4c824c943dfd05035bc4eef1
SHA1

f5ba7a99bc283a5cc527c9e978986e7efad1b4f0
SHA256

42d2c24e492154147631ad8360d730bc01bfb8e1f057563b5ba96fac199c438f
SHA512

3b69bbcd67456cfb326e432016d7c292746cb8ef5897ab2bb3322452b7424189713d944ee3f768cb8c320db805c6de1c634e980549c806d41724e02e07b43bd9
SSDEEP

3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  42d2c24e492154147631ad8360d730bc01bfb8e1f057563b5ba96fac199c438f
- Size
  
  394KB
- MD5
  
  0c985eba4c824c943dfd05035bc4eef1
- SHA1
  
  f5ba7a99bc283a5cc527c9e978986e7efad1b4f0
- SHA256
  
  42d2c24e492154147631ad8360d730bc01bfb8e1f057563b5ba96fac199c438f
- SHA512
  
  3b69bbcd67456cfb326e432016d7c292746cb8ef5897ab2bb3322452b7424189713d944ee3f768cb8c320db805c6de1c634e980549c806d41724e02e07b43bd9
- SSDEEP
  
  3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2