ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.bin
Size

123KB
Sample

230505-xkswpsfc86
MD5

c50a968d1c6351e9e087a56b1e5a1acd
SHA1

d9c4742a26bf41c5009f2e56f53ae9fab931a5b1
SHA256

ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed
SHA512

a98ff57f8246de2a0f9293559e5a4d34853a22bd0c85237d6662ecb81356c6466164e7f61345bbb1b31ed09ff61cb464732c5af8bb674601a3ebb6c703d009b7
SSDEEP

3072:wlrwbVaNHJLRnXsJynTQkQhYXzKexgUxTEe8ELcfffffffffU1:6sBaNp1synTQkQhYXzxSUBB9cffffffc

Score

9^/10

evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.bin
- Size
  
  123KB
- MD5
  
  c50a968d1c6351e9e087a56b1e5a1acd
- SHA1
  
  d9c4742a26bf41c5009f2e56f53ae9fab931a5b1
- SHA256
  
  ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed
- SHA512
  
  a98ff57f8246de2a0f9293559e5a4d34853a22bd0c85237d6662ecb81356c6466164e7f61345bbb1b31ed09ff61cb464732c5af8bb674601a3ebb6c703d009b7
- SSDEEP
  
  3072:wlrwbVaNHJLRnXsJynTQkQhYXzKexgUxTEe8ELcfffffffffU1:6sBaNp1synTQkQhYXzxSUBB9cffffffc
Score

9^/10

evasion persistence ransomware spyware stealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

evasionpersistenceransomwarespywarestealer

behavioral2

evasionpersistenceransomwarespywarestealer