b4a4ffb9cabeae1009168d7d94e2a25543f8aa18b875842ec3b26be4e6b57397 | Triage

Sharing

General

Target

b4a4ffb9cabeae1009168d7d94e2a25543f8aa18b875842ec3b26be4e6b57397
Size

863KB
Sample

221201-kf35naah43
MD5

5a2eb69cf29f3a22ab7e70f8effa7081
SHA1

dde351d6f97858d631a36a2474cc81ea5148afc6
SHA256

b4a4ffb9cabeae1009168d7d94e2a25543f8aa18b875842ec3b26be4e6b57397
SHA512

3a1bb5747b2d055ff7e5ee84123169e76094934a7658be50a8a468f8c63c11fab4040fc030a8d4173410ff93ba850405f1387c6203b930068ccc7cfa83e800e4
SSDEEP

12288:PwMEvREWayDKHYEuCPmgFuVPeAsSeEZE7BdRrkNP9W0Ycy7CCAi4ujlSYy:QRcHdjO7ZEjRkNP9LlCBgl

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  b4a4ffb9cabeae1009168d7d94e2a25543f8aa18b875842ec3b26be4e6b57397
- Size
  
  863KB
- MD5
  
  5a2eb69cf29f3a22ab7e70f8effa7081
- SHA1
  
  dde351d6f97858d631a36a2474cc81ea5148afc6
- SHA256
  
  b4a4ffb9cabeae1009168d7d94e2a25543f8aa18b875842ec3b26be4e6b57397
- SHA512
  
  3a1bb5747b2d055ff7e5ee84123169e76094934a7658be50a8a468f8c63c11fab4040fc030a8d4173410ff93ba850405f1387c6203b930068ccc7cfa83e800e4
- SSDEEP
  
  12288:PwMEvREWayDKHYEuCPmgFuVPeAsSeEZE7BdRrkNP9W0Ycy7CCAi4ujlSYy:QRcHdjO7ZEjRkNP9LlCBgl
Score

8^/10

discovery persistence spyware stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2