eaf78193cb71262a595e55223020e78a81851a6bf8bf0f08ef8870500031c77b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eaf78193cb71262a595e55223020e78a81851a6bf8bf0f08ef8870500031c77b
Size

644KB
Sample

230426-px6dkahd22
MD5

a8acb930633dee9430ea0eb5f252eea0
SHA1

0f50902aaa113f7fc168d18a30079b2de266b2b6
SHA256

eaf78193cb71262a595e55223020e78a81851a6bf8bf0f08ef8870500031c77b
SHA512

64d7d9136b84a8afc01951e3e5e7f448746a000b64829d5504b37261cd35b7e6a05e2a0eb5651f7122811b6f888042a4222e7000ba227cd5aa9d0af036eb983c
SSDEEP

12288:Ly90Ndpq7kaulJFpSNKBHZqkteDhZJv3QuZRvuGdx0iSHe7Fmmu0ok:Ly0dp6XK1JkvhfvB9Dune7Fe0ok

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  eaf78193cb71262a595e55223020e78a81851a6bf8bf0f08ef8870500031c77b
- Size
  
  644KB
- MD5
  
  a8acb930633dee9430ea0eb5f252eea0
- SHA1
  
  0f50902aaa113f7fc168d18a30079b2de266b2b6
- SHA256
  
  eaf78193cb71262a595e55223020e78a81851a6bf8bf0f08ef8870500031c77b
- SHA512
  
  64d7d9136b84a8afc01951e3e5e7f448746a000b64829d5504b37261cd35b7e6a05e2a0eb5651f7122811b6f888042a4222e7000ba227cd5aa9d0af036eb983c
- SSDEEP
  
  12288:Ly90Ndpq7kaulJFpSNKBHZqkteDhZJv3QuZRvuGdx0iSHe7Fmmu0ok:Ly0dp6XK1JkvhfvB9Dune7Fe0ok
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan