8170521074694e020239101d14e119c3ca3e8d7cf5fc33019282deef9915613d | Triage

Sharing

General

Target

8170521074694e020239101d14e119c3ca3e8d7cf5fc33019282deef9915613d
Size

693KB
Sample

230426-hxl7csff94
MD5

821a7f0a99a396b8dea17cc244ee2d87
SHA1

c5106591bd4a927c05873fd8fc4088cc2904f0a4
SHA256

8170521074694e020239101d14e119c3ca3e8d7cf5fc33019282deef9915613d
SHA512

8a33f957e2951708d6f4b4f771c6ee8c771cc34e769db3f955fe9428dfa29ad0f0ac90229fcda46ed52b54c4f793eafecee4972fe56a0db50fe4d7c6d6f5c65c
SSDEEP

12288:Uy903W1BYNw6yaXJiCY8CHdTaNfsvCYYlXmEz7wlR+uqVvpM:UyEW1BJ6MZ8xd5ms7l3M

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  8170521074694e020239101d14e119c3ca3e8d7cf5fc33019282deef9915613d
- Size
  
  693KB
- MD5
  
  821a7f0a99a396b8dea17cc244ee2d87
- SHA1
  
  c5106591bd4a927c05873fd8fc4088cc2904f0a4
- SHA256
  
  8170521074694e020239101d14e119c3ca3e8d7cf5fc33019282deef9915613d
- SHA512
  
  8a33f957e2951708d6f4b4f771c6ee8c771cc34e769db3f955fe9428dfa29ad0f0ac90229fcda46ed52b54c4f793eafecee4972fe56a0db50fe4d7c6d6f5c65c
- SSDEEP
  
  12288:Uy903W1BYNw6yaXJiCY8CHdTaNfsvCYYlXmEz7wlR+uqVvpM:UyEW1BJ6MZ8xd5ms7l3M
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan