da694821b804ce2b67f11616d232021309963a9a7d5cb21a0f92c9729ea02c3a | Triage

Sharing

General

Target

da694821b804ce2b67f11616d232021309963a9a7d5cb21a0f92c9729ea02c3a
Size

104KB
Sample

221129-grsxaafc81
MD5

79f302aa124239e2e3b91952a199d0a2
SHA1

6eac448a6f91937f22455ca5aef1eb4a1bf254cd
SHA256

da694821b804ce2b67f11616d232021309963a9a7d5cb21a0f92c9729ea02c3a
SHA512

f48cb8275a7f73699ea7ea9f26cf7f4fb080de6c0370fb68c0effe35214448da672ed2a0c378bb2aa2a8a78f4f80ce27c3caa7c6dbc8f1df5cefe989dea9cf0f
SSDEEP

1536:xTYd5QJc/vaSybs4eBReHbaxjg46o6qBH:V1c/2b5keuNg4HDH

Score

9^/10

spyware stealer

Malware Config

Targets

- Target
  
  da694821b804ce2b67f11616d232021309963a9a7d5cb21a0f92c9729ea02c3a
- Size
  
  104KB
- MD5
  
  79f302aa124239e2e3b91952a199d0a2
- SHA1
  
  6eac448a6f91937f22455ca5aef1eb4a1bf254cd
- SHA256
  
  da694821b804ce2b67f11616d232021309963a9a7d5cb21a0f92c9729ea02c3a
- SHA512
  
  f48cb8275a7f73699ea7ea9f26cf7f4fb080de6c0370fb68c0effe35214448da672ed2a0c378bb2aa2a8a78f4f80ce27c3caa7c6dbc8f1df5cefe989dea9cf0f
- SSDEEP
  
  1536:xTYd5QJc/vaSybs4eBReHbaxjg46o6qBH:V1c/2b5keuNg4HDH
Score

9^/10

spyware stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Account Manipulation

Privilege Escalation

Defense Evasion

Credential Access

Account Manipulation

Credentials in Files

Discovery

Process Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2