583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d
Size

943KB
Sample

230421-z1p6vshh73
MD5

a29e809d44553ccd266f174ea49b2d51
SHA1

119559cd61e275cd468daa76d4797c7685154268
SHA256

583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d
SHA512

8cf0022787aaa741a270367137fef0e910832995ff21db7d0825c637a0c8208f3eb1fd1ff4bcf168fed27ee681206bd5c442f66c3dc662a1972d0cf4e4a567af
SSDEEP

24576:RyXSNrtnBivPFdpx0WbKdmNnsC6Ch+7LvQak3M+yoqKNi:EXSNrdjdm6C6CUPQak3Mp2

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d
- Size
  
  943KB
- MD5
  
  a29e809d44553ccd266f174ea49b2d51
- SHA1
  
  119559cd61e275cd468daa76d4797c7685154268
- SHA256
  
  583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d
- SHA512
  
  8cf0022787aaa741a270367137fef0e910832995ff21db7d0825c637a0c8208f3eb1fd1ff4bcf168fed27ee681206bd5c442f66c3dc662a1972d0cf4e4a567af
- SSDEEP
  
  24576:RyXSNrtnBivPFdpx0WbKdmNnsC6Ch+7LvQak3M+yoqKNi:EXSNrdjdm6C6CUPQak3Mp2
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan