f42ecfb82a13539ed2d6d1017b0885f03f544986da3133f92369e4e9800662fd | Triage

Sharing

General

Target

f42ecfb82a13539ed2d6d1017b0885f03f544986da3133f92369e4e9800662fd
Size

704KB
Sample

230423-ts8qcagb21
MD5

ed6ef4beab143ce30821771511321c65
SHA1

614ada702ad18b3be33c439afda76a55492d1112
SHA256

f42ecfb82a13539ed2d6d1017b0885f03f544986da3133f92369e4e9800662fd
SHA512

cb46ac4992c1667e54a67d0becee7fe3e402599f36b5d14c987953c829e22974c544ef50db2ebdd23ee84ff3d09adb1fa3ba24e8a3b0544d456802605ebb392d
SSDEEP

12288:Ty90MEJtehqbG2pdwuj/DIN9gWF07RvWM3MKFwcmBl5wEOQDP3yi:Tyji9fwgbgXF04kMKucglKEOQD/yi

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  f42ecfb82a13539ed2d6d1017b0885f03f544986da3133f92369e4e9800662fd
- Size
  
  704KB
- MD5
  
  ed6ef4beab143ce30821771511321c65
- SHA1
  
  614ada702ad18b3be33c439afda76a55492d1112
- SHA256
  
  f42ecfb82a13539ed2d6d1017b0885f03f544986da3133f92369e4e9800662fd
- SHA512
  
  cb46ac4992c1667e54a67d0becee7fe3e402599f36b5d14c987953c829e22974c544ef50db2ebdd23ee84ff3d09adb1fa3ba24e8a3b0544d456802605ebb392d
- SSDEEP
  
  12288:Ty90MEJtehqbG2pdwuj/DIN9gWF07RvWM3MKFwcmBl5wEOQDP3yi:Tyji9fwgbgXF04kMKucglKEOQD/yi
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan