cf9ba937ee7caf9161b3a88e8d2f443e317d0169724188412f1dbe35d8b7c964 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf9ba937ee7caf9161b3a88e8d2f443e317d0169724188412f1dbe35d8b7c964
Size

850KB
Sample

221203-e3n2csea79
MD5

a950e01438cb234722148d7a42244c78
SHA1

f47231973f5e9786e1f8437bcefec7b980ee2009
SHA256

cf9ba937ee7caf9161b3a88e8d2f443e317d0169724188412f1dbe35d8b7c964
SHA512

4c36176f7028fe424e869362ac153cc1c431531c106d378d280c3f5092e4c3d53405b04d47d7346f30c6c87d720ffa4922f4b2ce72bc584c00e2a627a7e15b45
SSDEEP

12288:qCerSTtUCSTPLE6FmX9ONFU6Wtb4bzKmf4BaQSdE7EQHV5V5Fo92hYAqRLIA5Y3C:qxD4ftIKb6zKkzXQ7V5FhYVLnmp9QF

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  cf9ba937ee7caf9161b3a88e8d2f443e317d0169724188412f1dbe35d8b7c964
- Size
  
  850KB
- MD5
  
  a950e01438cb234722148d7a42244c78
- SHA1
  
  f47231973f5e9786e1f8437bcefec7b980ee2009
- SHA256
  
  cf9ba937ee7caf9161b3a88e8d2f443e317d0169724188412f1dbe35d8b7c964
- SHA512
  
  4c36176f7028fe424e869362ac153cc1c431531c106d378d280c3f5092e4c3d53405b04d47d7346f30c6c87d720ffa4922f4b2ce72bc584c00e2a627a7e15b45
- SSDEEP
  
  12288:qCerSTtUCSTPLE6FmX9ONFU6Wtb4bzKmf4BaQSdE7EQHV5V5Fo92hYAqRLIA5Y3C:qxD4ftIKb6zKkzXQ7V5FhYVLnmp9QF
Score

8^/10

discovery persistence spyware stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2