8d9e64e25fda112ed83f34a12ae795c5b4e5c820dd6cbdf64cd19b59999dc4ec | Triage

Sharing

General

Target

8d9e64e25fda112ed83f34a12ae795c5b4e5c820dd6cbdf64cd19b59999dc4ec
Size

177KB
Sample

221201-beew1aah72
MD5

3a8f12b1ff49d955726d07b1f61ae45d
SHA1

6a7ad4009ca314c95978245d945108b6843627cc
SHA256

8d9e64e25fda112ed83f34a12ae795c5b4e5c820dd6cbdf64cd19b59999dc4ec
SHA512

b8c998515bbe63382343d5f02ea6422714da108970682bc03c8a934a29b450a0fab0d73cf735a9dec5fbd64626988773f609f0d83b024ae25303f59eaf646f95
SSDEEP

3072:mMUNYUYRdZcw4TBQ8iwREthGiuFrrSSygvtpiC+/P+Etfe1xi8pGqQtjxy5B:oYRAwE28iyEthJuSSygvt5+H+Etfe1dF

Score

10^/10

persistence spyware stealer upx

Malware Config

Targets

- Target
  
  8d9e64e25fda112ed83f34a12ae795c5b4e5c820dd6cbdf64cd19b59999dc4ec
- Size
  
  177KB
- MD5
  
  3a8f12b1ff49d955726d07b1f61ae45d
- SHA1
  
  6a7ad4009ca314c95978245d945108b6843627cc
- SHA256
  
  8d9e64e25fda112ed83f34a12ae795c5b4e5c820dd6cbdf64cd19b59999dc4ec
- SHA512
  
  b8c998515bbe63382343d5f02ea6422714da108970682bc03c8a934a29b450a0fab0d73cf735a9dec5fbd64626988773f609f0d83b024ae25303f59eaf646f95
- SSDEEP
  
  3072:mMUNYUYRdZcw4TBQ8iwREthGiuFrrSSygvtpiC+/P+Etfe1xi8pGqQtjxy5B:oYRAwE28iyEthJuSSygvt5+H+Etfe1dF
Score

10^/10

persistence spyware stealer upx
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealerupx

behavioral2