cfce000372d59a7600a4ea49b509cb09f9fa03d90388a9a71746496cca83143e | Triage

Sharing

General

Target

cfce000372d59a7600a4ea49b509cb09f9fa03d90388a9a71746496cca83143e
Size

479KB
Sample

230505-cgqxqaga69
MD5

18d2f7e5aa6f7deb7088a0d8d3728cee
SHA1

e283ec24f3039775edc9f979e33e733b511408ff
SHA256

cfce000372d59a7600a4ea49b509cb09f9fa03d90388a9a71746496cca83143e
SHA512

35f993bdc9e3c9599a730c91895eaebba066ac12de2e833e19fdf991447a6bcb56e677af6a61bb3f6fd908fd61ab71bd12de61d2a9ca4060e0f30b848fc6327c
SSDEEP

12288:yMrpy90I3s0ale6d/B+81ba0n9DdUagzsxgZ3Fm:HyR3CVH+81baC9dFgo44

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  cfce000372d59a7600a4ea49b509cb09f9fa03d90388a9a71746496cca83143e
- Size
  
  479KB
- MD5
  
  18d2f7e5aa6f7deb7088a0d8d3728cee
- SHA1
  
  e283ec24f3039775edc9f979e33e733b511408ff
- SHA256
  
  cfce000372d59a7600a4ea49b509cb09f9fa03d90388a9a71746496cca83143e
- SHA512
  
  35f993bdc9e3c9599a730c91895eaebba066ac12de2e833e19fdf991447a6bcb56e677af6a61bb3f6fd908fd61ab71bd12de61d2a9ca4060e0f30b848fc6327c
- SSDEEP
  
  12288:yMrpy90I3s0ale6d/B+81ba0n9DdUagzsxgZ3Fm:HyR3CVH+81baC9dFgo44
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan