ecef06cce43e352b38f6375ec8395094111e985ff075071dba456f43f32ddb89 | Triage

Sharing

General

Target

ecef06cce43e352b38f6375ec8395094111e985ff075071dba456f43f32ddb89
Size

92KB
Sample

221205-qed22acf58
MD5

d173fa568e03d8fe35a36d72e5028cc5
SHA1

aa98a12bc226f79a3e3eebda3461c225434afe70
SHA256

ecef06cce43e352b38f6375ec8395094111e985ff075071dba456f43f32ddb89
SHA512

986f575eb94407df4795d554ebab460220c47e05a031435cf6b1d3cfd79ca6cb54904716bb2b6c9d5e336f9b35fa29a13a66f2ca32eb98c0320bfab10c5e3dd5
SSDEEP

1536:/a0kJO8PwA5DPNRUiRrVthIeqQJcRebXKvDNALKbR1XVOH:S9pfU0VthPqQJkebToXVOH

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  ecef06cce43e352b38f6375ec8395094111e985ff075071dba456f43f32ddb89
- Size
  
  92KB
- MD5
  
  d173fa568e03d8fe35a36d72e5028cc5
- SHA1
  
  aa98a12bc226f79a3e3eebda3461c225434afe70
- SHA256
  
  ecef06cce43e352b38f6375ec8395094111e985ff075071dba456f43f32ddb89
- SHA512
  
  986f575eb94407df4795d554ebab460220c47e05a031435cf6b1d3cfd79ca6cb54904716bb2b6c9d5e336f9b35fa29a13a66f2ca32eb98c0320bfab10c5e3dd5
- SSDEEP
  
  1536:/a0kJO8PwA5DPNRUiRrVthIeqQJcRebXKvDNALKbR1XVOH:S9pfU0VthPqQJkebToXVOH
Score

10^/10

persistence spyware stealer evasion trojan
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

evasionpersistencetrojan