ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8 | Triage

Sharing

General

Target

ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8
Size

220KB
Sample

221205-t6t44sbe4w
MD5

da6c73ba77ee86b9adeb6636e96a8632
SHA1

d9d77e87497ec970e759849385391b5dde418c0b
SHA256

ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8
SHA512

6ad4a37adbd4698a4fca42f96e7ef5d0588d4c077f9b1309f336f11c274397b4f6581e5b648c622a8cc849576ece2efbd53fb6c7854a0028c9bb8a27ce49a356
SSDEEP

3072:f1D6LeSl5Htc5ckACyJiMAx9yZw4tVD29TJEhA:9gewNiSJiMAx0WT

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8
- Size
  
  220KB
- MD5
  
  da6c73ba77ee86b9adeb6636e96a8632
- SHA1
  
  d9d77e87497ec970e759849385391b5dde418c0b
- SHA256
  
  ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8
- SHA512
  
  6ad4a37adbd4698a4fca42f96e7ef5d0588d4c077f9b1309f336f11c274397b4f6581e5b648c622a8cc849576ece2efbd53fb6c7854a0028c9bb8a27ce49a356
- SSDEEP
  
  3072:f1D6LeSl5Htc5ckACyJiMAx9yZw4tVD29TJEhA:9gewNiSJiMAx0WT
Score

8^/10

spyware stealer
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2