fb93f0f64e791ab1bbb96e61ec64bbba7bfddd37ab272cf7332f06d5b1206134 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb93f0f64e791ab1bbb96e61ec64bbba7bfddd37ab272cf7332f06d5b1206134
Size

508KB
Sample

221204-mprt4abb85
MD5

39399cca49d6970c895860e9ef7f0773
SHA1

8a96651f011a2727dd3ad082686b2a205b1fe259
SHA256

fb93f0f64e791ab1bbb96e61ec64bbba7bfddd37ab272cf7332f06d5b1206134
SHA512

52467718250542945e8973f2c53f62a8ea37b955c80b5d6c940411f2e7de18f66a56406149496fb88b00ab26221430ca4399ac926d1cf4ebca2023ef4206e542
SSDEEP

12288:PIugRf20oBTDR4v7UE32r9z0Luoeo4dl01DntSk:PIubR+S+T4DGtSk

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  fb93f0f64e791ab1bbb96e61ec64bbba7bfddd37ab272cf7332f06d5b1206134
- Size
  
  508KB
- MD5
  
  39399cca49d6970c895860e9ef7f0773
- SHA1
  
  8a96651f011a2727dd3ad082686b2a205b1fe259
- SHA256
  
  fb93f0f64e791ab1bbb96e61ec64bbba7bfddd37ab272cf7332f06d5b1206134
- SHA512
  
  52467718250542945e8973f2c53f62a8ea37b955c80b5d6c940411f2e7de18f66a56406149496fb88b00ab26221430ca4399ac926d1cf4ebca2023ef4206e542
- SSDEEP
  
  12288:PIugRf20oBTDR4v7UE32r9z0Luoeo4dl01DntSk:PIubR+S+T4DGtSk
Score

7^/10

spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2