b19a72e8a4d977e9e07479782487d70dea78a10303870f5fb1b928131a638072 | Triage

Sharing

General

Target

b19a72e8a4d977e9e07479782487d70dea78a10303870f5fb1b928131a638072
Size

560KB
Sample

230423-dvbkmaaf57
MD5

e6474b5f12f7bfba4b76af6e444260f5
SHA1

90152dd7fc980bb50219336431ed2236deff79b9
SHA256

b19a72e8a4d977e9e07479782487d70dea78a10303870f5fb1b928131a638072
SHA512

3b226785b5eab15e55db910d5eda60d2ff9e4bb11c2886de1942a8e055c8a4f54f0eeb6015ed8aa292c34b66f710201fcb88da3450c65d4680d98bed74a19366
SSDEEP

12288:zy90anPdBlBiRoEnApd1eSw7LphU5RFTB1B6udVJYEd:zyzXlwoPIriH4Rq

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  b19a72e8a4d977e9e07479782487d70dea78a10303870f5fb1b928131a638072
- Size
  
  560KB
- MD5
  
  e6474b5f12f7bfba4b76af6e444260f5
- SHA1
  
  90152dd7fc980bb50219336431ed2236deff79b9
- SHA256
  
  b19a72e8a4d977e9e07479782487d70dea78a10303870f5fb1b928131a638072
- SHA512
  
  3b226785b5eab15e55db910d5eda60d2ff9e4bb11c2886de1942a8e055c8a4f54f0eeb6015ed8aa292c34b66f710201fcb88da3450c65d4680d98bed74a19366
- SSDEEP
  
  12288:zy90anPdBlBiRoEnApd1eSw7LphU5RFTB1B6udVJYEd:zyzXlwoPIriH4Rq
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan