71149c24072f58eccb67c6ed54356adca5287c31fc5fb4edbf94927bb7184eee | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71149c24072f58eccb67c6ed54356adca5287c31fc5fb4edbf94927bb7184eee
Size

612KB
Sample

230424-sfcxgacf39
MD5

74629a68e1d58d7f824ac582de8d960c
SHA1

646cc687c335702d7e1309d8cac37ba43e605041
SHA256

71149c24072f58eccb67c6ed54356adca5287c31fc5fb4edbf94927bb7184eee
SHA512

416ff3e9f7f6aca59eb9b210b985ae9ae5f0bed9276ef0bdedd8698c71dfa937cf0ccb190507ee721c41d23053c651f7bfed5fdb9ad77e3e42fa3816fb38e243
SSDEEP

12288:Ey90vnQqgobbHi6W5xpwuvr7E1hnkuBA7SI:EyAQq5HD6KuD4c0I

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  71149c24072f58eccb67c6ed54356adca5287c31fc5fb4edbf94927bb7184eee
- Size
  
  612KB
- MD5
  
  74629a68e1d58d7f824ac582de8d960c
- SHA1
  
  646cc687c335702d7e1309d8cac37ba43e605041
- SHA256
  
  71149c24072f58eccb67c6ed54356adca5287c31fc5fb4edbf94927bb7184eee
- SHA512
  
  416ff3e9f7f6aca59eb9b210b985ae9ae5f0bed9276ef0bdedd8698c71dfa937cf0ccb190507ee721c41d23053c651f7bfed5fdb9ad77e3e42fa3816fb38e243
- SSDEEP
  
  12288:Ey90vnQqgobbHi6W5xpwuvr7E1hnkuBA7SI:EyAQq5HD6KuD4c0I
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan