631d7e6e0d9b03928ea24c0f846e3aad741bd675b8837035e8bdc028dc25fc98 | Triage

Resubmissions

22-05-2023 08:14

230522-j48vdafa34 10

30-03-2023 14:59

230330-scqn6adb45 7

Sharing

General

Target

5a1a37fb68eeb445df8c647dab8af952.exe
Size

48KB
Sample

230330-scqn6adb45
MD5

5a1a37fb68eeb445df8c647dab8af952
SHA1

95f2c1a9ae32d39ed616d2007bbcf6f74feba18f
SHA256

631d7e6e0d9b03928ea24c0f846e3aad741bd675b8837035e8bdc028dc25fc98
SHA512

349c588d9fc96ecf4db16004afec719e00e6ec887a4d89319a150b9ef75b1836fb8dfbff1a1fc0953a0dccf6a27ae117a00cd94c0991ecc70931fd1349cd8d05
SSDEEP

768:4g/hgfJYO9KqosayemfSbvZ5l9GCAPk2/PWC/cEnUSBQtP9:R/hgGO9KrHmKbvtelRJnUSBiP9

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  5a1a37fb68eeb445df8c647dab8af952.exe
- Size
  
  48KB
- MD5
  
  5a1a37fb68eeb445df8c647dab8af952
- SHA1
  
  95f2c1a9ae32d39ed616d2007bbcf6f74feba18f
- SHA256
  
  631d7e6e0d9b03928ea24c0f846e3aad741bd675b8837035e8bdc028dc25fc98
- SHA512
  
  349c588d9fc96ecf4db16004afec719e00e6ec887a4d89319a150b9ef75b1836fb8dfbff1a1fc0953a0dccf6a27ae117a00cd94c0991ecc70931fd1349cd8d05
- SSDEEP
  
  768:4g/hgfJYO9KqosayemfSbvZ5l9GCAPk2/PWC/cEnUSBQtP9:R/hgGO9KrHmKbvtelRJnUSBiP9
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2