ccccde0cea3077aa1e11147b4620337b26641c19e2a76d5b0b6eb08e366afc49 | Triage

Sharing

General

Target

ccccde0cea3077aa1e11147b4620337b26641c19e2a76d5b0b6eb08e366afc49
Size

566KB
Sample

230423-hrr6esdd8y
MD5

f25086c6c690869b401d82909770906a
SHA1

af5bb4de64ba2c5abb7532d129fef523ee650923
SHA256

ccccde0cea3077aa1e11147b4620337b26641c19e2a76d5b0b6eb08e366afc49
SHA512

f81714888c798fa02bd9dc7f54f3f509a6b77d1a8582e7307208e51cad37bf0e160684b4dfc302b9690910eef4c2b22843e0b150bad53ae24025b38a87aa2285
SSDEEP

12288:ny90AYq4XDtUICRF7DmpsrgVPBXF9miQZ7fy6i0tLD0cdtbbWgphiLi:nyu3ztyFDmB9BV9mi87aUBdwOhr

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  ccccde0cea3077aa1e11147b4620337b26641c19e2a76d5b0b6eb08e366afc49
- Size
  
  566KB
- MD5
  
  f25086c6c690869b401d82909770906a
- SHA1
  
  af5bb4de64ba2c5abb7532d129fef523ee650923
- SHA256
  
  ccccde0cea3077aa1e11147b4620337b26641c19e2a76d5b0b6eb08e366afc49
- SHA512
  
  f81714888c798fa02bd9dc7f54f3f509a6b77d1a8582e7307208e51cad37bf0e160684b4dfc302b9690910eef4c2b22843e0b150bad53ae24025b38a87aa2285
- SSDEEP
  
  12288:ny90AYq4XDtUICRF7DmpsrgVPBXF9miQZ7fy6i0tLD0cdtbbWgphiLi:nyu3ztyFDmB9BV9mi87aUBdwOhr
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan