24083fe40d2bd62fade635a7c552c2eec9bf05db1afe60ec6df996f721e07279 | Triage

Sharing

General

Target

24083fe40d2bd62fade635a7c552c2eec9bf05db1afe60ec6df996f721e07279
Size

167KB
Sample

221125-z5b5ssff77
MD5

ffcf2d2ae3f5741f0399c6d4400b3a8c
SHA1

2d0c1e053815dede4a6878114be81cd9e760b4c1
SHA256

24083fe40d2bd62fade635a7c552c2eec9bf05db1afe60ec6df996f721e07279
SHA512

96d54c23ad487cd7ed96bf619cb689c254e6c00671cc897cca8373f89291355c5ead737e141ff8a06c6a5be114925b18fdbbab1bf2f6d804027303b40905a951
SSDEEP

3072:y06b18QZe99UnrMlc/QwWghQPZepNow3rRQ7Ru:N6b18QZewrM1wrCYow0A

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  24083fe40d2bd62fade635a7c552c2eec9bf05db1afe60ec6df996f721e07279
- Size
  
  167KB
- MD5
  
  ffcf2d2ae3f5741f0399c6d4400b3a8c
- SHA1
  
  2d0c1e053815dede4a6878114be81cd9e760b4c1
- SHA256
  
  24083fe40d2bd62fade635a7c552c2eec9bf05db1afe60ec6df996f721e07279
- SHA512
  
  96d54c23ad487cd7ed96bf619cb689c254e6c00671cc897cca8373f89291355c5ead737e141ff8a06c6a5be114925b18fdbbab1bf2f6d804027303b40905a951
- SSDEEP
  
  3072:y06b18QZe99UnrMlc/QwWghQPZepNow3rRQ7Ru:N6b18QZewrM1wrCYow0A
Score

7^/10

discovery spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2