be344a09726ffd7ca31e6ed5f34a315d734354da59f36228af501a871cd4cbfa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be344a09726ffd7ca31e6ed5f34a315d734354da59f36228af501a871cd4cbfa
Size

284KB
Sample

221125-wkehmsgf4z
MD5

506d77222f21493d75e71d3905c690a7
SHA1

c71e6ca17343bc1e129f0614ab8e405b8d7700f1
SHA256

be344a09726ffd7ca31e6ed5f34a315d734354da59f36228af501a871cd4cbfa
SHA512

03805cfbfc788eda803735f9069751dc7f94a4bd274cbda61a044edd00ccf8adecf09ccc6edfe91f12e9e2ffeb4dfa0bb52b17378e684703a728045c08038128
SSDEEP

6144:x7LspskHxpvG1KrO0QubYqpv7OQv5MdMvD5+H:jkxpeqOu0a/CmV+

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  be344a09726ffd7ca31e6ed5f34a315d734354da59f36228af501a871cd4cbfa
- Size
  
  284KB
- MD5
  
  506d77222f21493d75e71d3905c690a7
- SHA1
  
  c71e6ca17343bc1e129f0614ab8e405b8d7700f1
- SHA256
  
  be344a09726ffd7ca31e6ed5f34a315d734354da59f36228af501a871cd4cbfa
- SHA512
  
  03805cfbfc788eda803735f9069751dc7f94a4bd274cbda61a044edd00ccf8adecf09ccc6edfe91f12e9e2ffeb4dfa0bb52b17378e684703a728045c08038128
- SSDEEP
  
  6144:x7LspskHxpvG1KrO0QubYqpv7OQv5MdMvD5+H:jkxpeqOu0a/CmV+
Score

7^/10

discovery spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer