37734f07de556239f7134da6cc9b2ae04bb9a3b6ddfc57a0f011445417a7d721 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37734f07de556239f7134da6cc9b2ae04bb9a3b6ddfc57a0f011445417a7d721
Size

747KB
Sample

230424-qdnvvadf3v
MD5

3faff94b251d908248badacfa5658a5e
SHA1

a2b9f086de7238086a1b4f17a5355b3745db849c
SHA256

37734f07de556239f7134da6cc9b2ae04bb9a3b6ddfc57a0f011445417a7d721
SHA512

b7ff1c9aa5ba866c237b5ab1f60cd7989a75a48b19197318950c3a4fac8955762ccb0df499c432b41148e30339a6c58d2de813c2c4d50e719e0eff2658a8a0b3
SSDEEP

12288:Ty905opZw7w95l2+qPRke7X13pUpKEZavWYvTm9p:Tygom+qWWXlE7cxa

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  37734f07de556239f7134da6cc9b2ae04bb9a3b6ddfc57a0f011445417a7d721
- Size
  
  747KB
- MD5
  
  3faff94b251d908248badacfa5658a5e
- SHA1
  
  a2b9f086de7238086a1b4f17a5355b3745db849c
- SHA256
  
  37734f07de556239f7134da6cc9b2ae04bb9a3b6ddfc57a0f011445417a7d721
- SHA512
  
  b7ff1c9aa5ba866c237b5ab1f60cd7989a75a48b19197318950c3a4fac8955762ccb0df499c432b41148e30339a6c58d2de813c2c4d50e719e0eff2658a8a0b3
- SSDEEP
  
  12288:Ty905opZw7w95l2+qPRke7X13pUpKEZavWYvTm9p:Tygom+qWWXlE7cxa
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan