3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871 | Triage

Sharing

General

Target

3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871
Size

705KB
Sample

230422-f7da4ach72
MD5

ac5eb0c24b5270a782158735dc67c3cb
SHA1

cede90760f6e0d2954436862c6c3fe9c2057e760
SHA256

3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871
SHA512

f41fe995bffa7dc1863787a70d77c39d3f44d65c7392372750bb57cf7ece1f13a068c6a5d57e3d711f48cf5140684580e92c1e107ec0534a1cf295c2bea66794
SSDEEP

12288:ky903+JevpSPHJ64BpFIpFywW3f4bEGdrOJY8c0nZZJeGcw8BBev:kyMCeBqtFekwW3fIEQrOTcM3cw8BBev

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871
- Size
  
  705KB
- MD5
  
  ac5eb0c24b5270a782158735dc67c3cb
- SHA1
  
  cede90760f6e0d2954436862c6c3fe9c2057e760
- SHA256
  
  3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871
- SHA512
  
  f41fe995bffa7dc1863787a70d77c39d3f44d65c7392372750bb57cf7ece1f13a068c6a5d57e3d711f48cf5140684580e92c1e107ec0534a1cf295c2bea66794
- SSDEEP
  
  12288:ky903+JevpSPHJ64BpFIpFywW3f4bEGdrOJY8c0nZZJeGcw8BBev:kyMCeBqtFekwW3fIEQrOTcM3cw8BBev
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan