ed85e8da3d6ae1a18bc93cafe853db31be4e7a2359b9a5d012ab39ff5dd90cc5 | Triage

Sharing

General

Target

ed85e8da3d6ae1a18bc93cafe853db31be4e7a2359b9a5d012ab39ff5dd90cc5
Size

643KB
Sample

230426-lv61jage82
MD5

9dcadb17cacb81279cfc2512209c5b0d
SHA1

f628aaba9e556659abe9ae33ebc12068689d77ac
SHA256

ed85e8da3d6ae1a18bc93cafe853db31be4e7a2359b9a5d012ab39ff5dd90cc5
SHA512

714f9c85c5e5d9dccb7b41bd183999e4815d7cbc894b07acc89f81f7a2a1dcf5b07d749050e024f4f9f8ae5267d3e59ddf8881a82c0e776cb481502e79a44ca2
SSDEEP

12288:py90krz3fvzsKm2iZq7cy+XugRlrgQAZRluzHx0iS3e7fPUq4U3Xbe7b:pyxHtRik7cTXTzcXj+uXe7fPUdU3X67b

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  ed85e8da3d6ae1a18bc93cafe853db31be4e7a2359b9a5d012ab39ff5dd90cc5
- Size
  
  643KB
- MD5
  
  9dcadb17cacb81279cfc2512209c5b0d
- SHA1
  
  f628aaba9e556659abe9ae33ebc12068689d77ac
- SHA256
  
  ed85e8da3d6ae1a18bc93cafe853db31be4e7a2359b9a5d012ab39ff5dd90cc5
- SHA512
  
  714f9c85c5e5d9dccb7b41bd183999e4815d7cbc894b07acc89f81f7a2a1dcf5b07d749050e024f4f9f8ae5267d3e59ddf8881a82c0e776cb481502e79a44ca2
- SSDEEP
  
  12288:py90krz3fvzsKm2iZq7cy+XugRlrgQAZRluzHx0iS3e7fPUq4U3Xbe7b:pyxHtRik7cTXTzcXj+uXe7fPUdU3X67b
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan