ef9e2642cd75317c8491019600beeab1274892682829954e7339f847de5b22b5 | Triage

Sharing

General

Target

file.exe
Size

583KB
Sample

221226-waklxage2z
MD5

bac22670cdf54898180a97af5167354b
SHA1

0fbd7308d065e0f2bd13f367e5973595a8faca9c
SHA256

ef9e2642cd75317c8491019600beeab1274892682829954e7339f847de5b22b5
SHA512

a7ab2456a26046675ce596b1d0b53d7caf9dc93d933b88d5e82f5c8d71c5f9eb83ba58cd47852e5d742ff5a1739d9f87213389058cd917a908a5238c7aad78dd
SSDEEP

12288:lk8yqhhsVLrhXPrid6UI5SZD/trT1un6DlS7AZHUquav76T5l:zgLd2dFTYn6xQACqS

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  583KB
- MD5
  
  bac22670cdf54898180a97af5167354b
- SHA1
  
  0fbd7308d065e0f2bd13f367e5973595a8faca9c
- SHA256
  
  ef9e2642cd75317c8491019600beeab1274892682829954e7339f847de5b22b5
- SHA512
  
  a7ab2456a26046675ce596b1d0b53d7caf9dc93d933b88d5e82f5c8d71c5f9eb83ba58cd47852e5d742ff5a1739d9f87213389058cd917a908a5238c7aad78dd
- SSDEEP
  
  12288:lk8yqhhsVLrhXPrid6UI5SZD/trT1un6DlS7AZHUquav76T5l:zgLd2dFTYn6xQACqS
Score

7^/10

spyware stealer
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2