bf0c67e552583d6c34a711003d88018125fa45b4cb729238963f45814decb1d8 | Triage

Sharing

General

Target

bf0c67e552583d6c34a711003d88018125fa45b4cb729238963f45814decb1d8
Size

208KB
Sample

221203-gq24kaeb8v
MD5

4511919c645b66ce1748d3c0b8baed67
SHA1

7adb4a1ac7b9eacfc12fb5fdaab03bc8038a800c
SHA256

bf0c67e552583d6c34a711003d88018125fa45b4cb729238963f45814decb1d8
SHA512

69f7a55c458ba6fa3793abf8c47bb33b87e286b98bac9942531995469a27bfe0fdfa5e717034a63ef91d21a792595a157630216b70b39ced44d55e5132803ea0
SSDEEP

3072:U7+U3l+NAtqhuFburcczRx95Ir8KAsSAYzwH8q9o3Zoq:UyUgetHUocNx9AALAstqw

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  bf0c67e552583d6c34a711003d88018125fa45b4cb729238963f45814decb1d8
- Size
  
  208KB
- MD5
  
  4511919c645b66ce1748d3c0b8baed67
- SHA1
  
  7adb4a1ac7b9eacfc12fb5fdaab03bc8038a800c
- SHA256
  
  bf0c67e552583d6c34a711003d88018125fa45b4cb729238963f45814decb1d8
- SHA512
  
  69f7a55c458ba6fa3793abf8c47bb33b87e286b98bac9942531995469a27bfe0fdfa5e717034a63ef91d21a792595a157630216b70b39ced44d55e5132803ea0
- SSDEEP
  
  3072:U7+U3l+NAtqhuFburcczRx95Ir8KAsSAYzwH8q9o3Zoq:UyUgetHUocNx9AALAstqw
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer