e4ec4b4a139efb8d6076ccf1eda142f8174b8e8828587572608183868c2f3423 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e4ec4b4a139efb8d6076ccf1eda142f8174b8e8828587572608183868c2f3423
Size

706KB
Sample

230423-eawkqscd7x
MD5

defc2deac6eb4af228ad620fb61e67da
SHA1

c2fd4a2b13b5afa15f8d1f646d98d2262b23e97c
SHA256

e4ec4b4a139efb8d6076ccf1eda142f8174b8e8828587572608183868c2f3423
SHA512

889048f7049e5ab6079d8c4a7892a13c8efc11889030e4d791a34ae3f4500197c880597f830efe10d21cacf27be950217d2002570ffabae061fd63e18a5efd39
SSDEEP

12288:py90DX0VgG/Fi7w68MJUtE6WLOQGImpB1uGFTn1squfVJxici:py2XkgGW8MJ2EHOfImxRrsif

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  e4ec4b4a139efb8d6076ccf1eda142f8174b8e8828587572608183868c2f3423
- Size
  
  706KB
- MD5
  
  defc2deac6eb4af228ad620fb61e67da
- SHA1
  
  c2fd4a2b13b5afa15f8d1f646d98d2262b23e97c
- SHA256
  
  e4ec4b4a139efb8d6076ccf1eda142f8174b8e8828587572608183868c2f3423
- SHA512
  
  889048f7049e5ab6079d8c4a7892a13c8efc11889030e4d791a34ae3f4500197c880597f830efe10d21cacf27be950217d2002570ffabae061fd63e18a5efd39
- SSDEEP
  
  12288:py90DX0VgG/Fi7w68MJUtE6WLOQGImpB1uGFTn1squfVJxici:py2XkgGW8MJ2EHOfImxRrsif
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan