0892a393f522d89cde40e84193c56dc0f9ce06a082c3e73577cbabdfa8e6aff2 | Triage

Resubmissions

23/04/2023, 09:47

230423-lsh6paec4t 7

Sharing

Copy URL Twitter E-mail

General

Target

XPloit.exe
Size

16.9MB
Sample

230423-lsh6paec4t
MD5

5d340855d9692a2a6554af9d7d014d24
SHA1

ba144aa94d1f81fcc470c8e07c4b778ce337f64b
SHA256

0892a393f522d89cde40e84193c56dc0f9ce06a082c3e73577cbabdfa8e6aff2
SHA512

c0d68673746819708ed1ad049240720e1e354d74f89878b2578da364b339ba8fd65233b0157b926b2253e590401ceeb5b7e4a5aee016cf06c3275517af5fda69
SSDEEP

393216:9u7L/5UzBT1obI/hvaCncSQynKhs4Gpa66g7BMZyJPJypN/CZ3+iY:9CLxOx1h/hiCnhQfhs4JDg7BMZgPcjgu

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  XPloit.exe
- Size
  
  16.9MB
- MD5
  
  5d340855d9692a2a6554af9d7d014d24
- SHA1
  
  ba144aa94d1f81fcc470c8e07c4b778ce337f64b
- SHA256
  
  0892a393f522d89cde40e84193c56dc0f9ce06a082c3e73577cbabdfa8e6aff2
- SHA512
  
  c0d68673746819708ed1ad049240720e1e354d74f89878b2578da364b339ba8fd65233b0157b926b2253e590401ceeb5b7e4a5aee016cf06c3275517af5fda69
- SSDEEP
  
  393216:9u7L/5UzBT1obI/hvaCncSQynKhs4Gpa66g7BMZyJPJypN/CZ3+iY:9CLxOx1h/hiCnhQfhs4JDg7BMZgPcjgu
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2