19870ef370bff5ae4b853440fb9e4fa339a4ac4a7ed5eeada1c55e62768f01ac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19870ef370bff5ae4b853440fb9e4fa339a4ac4a7ed5eeada1c55e62768f01ac
Size

1.4MB
Sample

221127-t7mrescc86
MD5

31cbddc2dc168ed87f5d7d597f6d054e
SHA1

d3c21ac8038e48c4c53b96c1d37921e28222ddcc
SHA256

19870ef370bff5ae4b853440fb9e4fa339a4ac4a7ed5eeada1c55e62768f01ac
SHA512

014e9562a764f01c29e71556df2c9ae9768e2547e83056d3f5eb3f82693aade10f437c75eee29b8eb841f11019e491408b2ef77fa990c5e239d960f4c605bdb0
SSDEEP

24576:Gwa2WYC3X9ovTzB4uOG6A4Sgt8G0+j4OHISDWjb5IsEi0cTG0tV0EZ:pd8X9Szd76A4S68o31DOm6TG0tV0EZ

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  19870ef370bff5ae4b853440fb9e4fa339a4ac4a7ed5eeada1c55e62768f01ac
- Size
  
  1.4MB
- MD5
  
  31cbddc2dc168ed87f5d7d597f6d054e
- SHA1
  
  d3c21ac8038e48c4c53b96c1d37921e28222ddcc
- SHA256
  
  19870ef370bff5ae4b853440fb9e4fa339a4ac4a7ed5eeada1c55e62768f01ac
- SHA512
  
  014e9562a764f01c29e71556df2c9ae9768e2547e83056d3f5eb3f82693aade10f437c75eee29b8eb841f11019e491408b2ef77fa990c5e239d960f4c605bdb0
- SSDEEP
  
  24576:Gwa2WYC3X9ovTzB4uOG6A4Sgt8G0+j4OHISDWjb5IsEi0cTG0tV0EZ:pd8X9Szd76A4S68o31DOm6TG0tV0EZ
Score

8^/10

discovery evasion spyware stealer trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionspywarestealertrojan

behavioral2