835f42aea7d113f8a6621d503079b32227181ec84e66c4bb968b29ab19f631ae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

835f42aea7d113f8a6621d503079b32227181ec84e66c4bb968b29ab19f631ae
Size

1.6MB
Sample

230504-rppryseg8v
MD5

224843dbecca4c0b336a920f78b7e330
SHA1

060b93e0c675e0d978ca2c6a9ba7ac5cc04fd64f
SHA256

835f42aea7d113f8a6621d503079b32227181ec84e66c4bb968b29ab19f631ae
SHA512

2573bf24edaec4ada81bc907caf27dbf203711e1f4f1de40fc3a7c8337ca4a9ba9e2836e492c40bb956f560eacd5800596d6342ce3b9dcd565213c9e0174780d
SSDEEP

24576:Ay8kTmOE3zkA5p/8qSZ9oCgiYHYglrcvr0oN4p0/U+yOlJZFZNfYnI7987NW:HLfEDkSgro/izEczjj/3blrNQI79u

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  835f42aea7d113f8a6621d503079b32227181ec84e66c4bb968b29ab19f631ae
- Size
  
  1.6MB
- MD5
  
  224843dbecca4c0b336a920f78b7e330
- SHA1
  
  060b93e0c675e0d978ca2c6a9ba7ac5cc04fd64f
- SHA256
  
  835f42aea7d113f8a6621d503079b32227181ec84e66c4bb968b29ab19f631ae
- SHA512
  
  2573bf24edaec4ada81bc907caf27dbf203711e1f4f1de40fc3a7c8337ca4a9ba9e2836e492c40bb956f560eacd5800596d6342ce3b9dcd565213c9e0174780d
- SSDEEP
  
  24576:Ay8kTmOE3zkA5p/8qSZ9oCgiYHYglrcvr0oN4p0/U+yOlJZFZNfYnI7987NW:HLfEDkSgro/izEczjj/3blrNQI79u
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan