138bae1f48b4b21ca9959fdcf46a4776b68af3590aa2c9ff2b7d7650c5a97a76 | Triage

Sharing

General

Target

fe4333d113f866f464884bb210088104.bin
Size

68KB
Sample

230503-c1swesfc3t
MD5

fe4333d113f866f464884bb210088104
SHA1

416f83c1d0aa26809eebfe5446ab79db5d977cf6
SHA256

138bae1f48b4b21ca9959fdcf46a4776b68af3590aa2c9ff2b7d7650c5a97a76
SHA512

631fe174d79b4d3620748274d18615d6f0b049ad4e6002a7da4301473516f441ee549aaf3aaf9fe53fd4df68c78763826e7ba95cefcf233b8549728c12495ffc
SSDEEP

1536:kMozyQo9+pwSgFf076fU6OcossWjcdDvE+VOaF2c:k8axw5sdzDM8pf

Score

8^/10

persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  fe4333d113f866f464884bb210088104.bin
- Size
  
  68KB
- MD5
  
  fe4333d113f866f464884bb210088104
- SHA1
  
  416f83c1d0aa26809eebfe5446ab79db5d977cf6
- SHA256
  
  138bae1f48b4b21ca9959fdcf46a4776b68af3590aa2c9ff2b7d7650c5a97a76
- SHA512
  
  631fe174d79b4d3620748274d18615d6f0b049ad4e6002a7da4301473516f441ee549aaf3aaf9fe53fd4df68c78763826e7ba95cefcf233b8549728c12495ffc
- SSDEEP
  
  1536:kMozyQo9+pwSgFf076fU6OcossWjcdDvE+VOaF2c:k8axw5sdzDM8pf
Score

8^/10

persistence spyware stealer ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistenceransomwarespywarestealer