a72621729748f83ae6c15d5633f37302b972ea1e5b224cbc0a181797cb574b96 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a72621729748f83ae6c15d5633f37302b972ea1e5b224cbc0a181797cb574b96
Size

376KB
Sample

230505-nvjaksbh6y
MD5

62299062d536f51e2b63f7fd675cad4a
SHA1

a63104f47127feeace5496e0bbef7c004e3d0c9a
SHA256

a72621729748f83ae6c15d5633f37302b972ea1e5b224cbc0a181797cb574b96
SHA512

9b6bd1e24cd904cede05a3a4f6f3268ee6accceb99e8b4f04506d3c2700e61acc0a73138d0e29392fac53d283a9f209af869854c476523f604843b33f44b6b8e
SSDEEP

6144:Kly+bnr+8p0yN90QER284eP6+sAPgsOhWN/keIZk6JrA3gg4OGCIrePScRO+me:XMr0y90r4ey+sAo/hWWjZBJAggSCIrta

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  a72621729748f83ae6c15d5633f37302b972ea1e5b224cbc0a181797cb574b96
- Size
  
  376KB
- MD5
  
  62299062d536f51e2b63f7fd675cad4a
- SHA1
  
  a63104f47127feeace5496e0bbef7c004e3d0c9a
- SHA256
  
  a72621729748f83ae6c15d5633f37302b972ea1e5b224cbc0a181797cb574b96
- SHA512
  
  9b6bd1e24cd904cede05a3a4f6f3268ee6accceb99e8b4f04506d3c2700e61acc0a73138d0e29392fac53d283a9f209af869854c476523f604843b33f44b6b8e
- SSDEEP
  
  6144:Kly+bnr+8p0yN90QER284eP6+sAPgsOhWN/keIZk6JrA3gg4OGCIrePScRO+me:XMr0y90r4ey+sAo/hWWjZBJAggSCIrta
Score

10^/10

discovery evasion persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealertrojan