46e6e163e3bc57ea482de4c30f4c74df76507b7dde9db089802bf28107be0410 | Triage

Sharing

General

Target

46e6e163e3bc57ea482de4c30f4c74df76507b7dde9db089802bf28107be0410
Size

566KB
Sample

230423-ls2yssec4w
MD5

4ab7a6452e1f696820d332abc96f09a2
SHA1

62f41a35c831eefd2a3400606c63c6eb8b07c2b2
SHA256

46e6e163e3bc57ea482de4c30f4c74df76507b7dde9db089802bf28107be0410
SHA512

f62762995f597531dceea7ca6abacb881b680fc5a82ea8fc9fd2aa0a1a03e0fd772c1ab8b917249adf7db1cfc2c0769d6cda9620b4a6f555a301d7e44246d1f5
SSDEEP

12288:xy90CkFVjZDjw9nRiRLKs+oY6m1XteBXwbaW:xycVjxanRiRLj+oY60X0JeaW

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  46e6e163e3bc57ea482de4c30f4c74df76507b7dde9db089802bf28107be0410
- Size
  
  566KB
- MD5
  
  4ab7a6452e1f696820d332abc96f09a2
- SHA1
  
  62f41a35c831eefd2a3400606c63c6eb8b07c2b2
- SHA256
  
  46e6e163e3bc57ea482de4c30f4c74df76507b7dde9db089802bf28107be0410
- SHA512
  
  f62762995f597531dceea7ca6abacb881b680fc5a82ea8fc9fd2aa0a1a03e0fd772c1ab8b917249adf7db1cfc2c0769d6cda9620b4a6f555a301d7e44246d1f5
- SSDEEP
  
  12288:xy90CkFVjZDjw9nRiRLKs+oY6m1XteBXwbaW:xycVjxanRiRLj+oY60X0JeaW
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan