e019476cf6ce1377d170d47b548429d64a6d47050c1d848c9e376a277e1f1bb0 | Triage

Sharing

General

Target

e019476cf6ce1377d170d47b548429d64a6d47050c1d848c9e376a277e1f1bb0
Size

706KB
Sample

230423-n7pccsdb78
MD5

e2d0ceb62c9a3babc9d4d20167a1b383
SHA1

ae7caf5526eb1634661c0760e2b4bcf8da099fa5
SHA256

e019476cf6ce1377d170d47b548429d64a6d47050c1d848c9e376a277e1f1bb0
SHA512

d32d456c528a871dd5dd5247df60e695c854a3f5b482352cbe8105b31ffe207bc2a83aff4f1c47c445546a99349e4b13d3694b65180d3bb77bfe87f33732e10d
SSDEEP

12288:Oy90fv3eHb5OBSSvaxwtnZgFgAbt8VcYdRD+9wjeMdg2boyzP9qCxOlMSRGHNuaw:Oy02cHFZeSTdR69w5Zcy0CglMzt2x

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  e019476cf6ce1377d170d47b548429d64a6d47050c1d848c9e376a277e1f1bb0
- Size
  
  706KB
- MD5
  
  e2d0ceb62c9a3babc9d4d20167a1b383
- SHA1
  
  ae7caf5526eb1634661c0760e2b4bcf8da099fa5
- SHA256
  
  e019476cf6ce1377d170d47b548429d64a6d47050c1d848c9e376a277e1f1bb0
- SHA512
  
  d32d456c528a871dd5dd5247df60e695c854a3f5b482352cbe8105b31ffe207bc2a83aff4f1c47c445546a99349e4b13d3694b65180d3bb77bfe87f33732e10d
- SSDEEP
  
  12288:Oy90fv3eHb5OBSSvaxwtnZgFgAbt8VcYdRD+9wjeMdg2boyzP9qCxOlMSRGHNuaw:Oy02cHFZeSTdR69w5Zcy0CglMzt2x
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan