e10f1e70fa84b2d135123e72e4c46770d9f663f0c2036e3e7a4e7a3bf8cd5f96 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a8465df8b12904a5d7a38fc1b6ae300.exe
Size

264KB
Sample

230603-29sdpaah3w
MD5

3a8465df8b12904a5d7a38fc1b6ae300
SHA1

5a88a335d9de71dadcf1fbbfc5f25384bac0c460
SHA256

e10f1e70fa84b2d135123e72e4c46770d9f663f0c2036e3e7a4e7a3bf8cd5f96
SHA512

97a681b060301437ef9dca6867f526e3338862dc2e6ae352ca76cd46e440e250d3c6e13a7d82627d4618d63cc92e2414e451adb67abe731f78f9b86fcdfa3aae
SSDEEP

3072:NTWEhkRkN8P+1YD4HZHVNP2k627LIyewPd+jKXQO5Zs0hGV5j3jIWsei2/:NyEh5Nw4HdVe279VEcXThe53jgm

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  3a8465df8b12904a5d7a38fc1b6ae300.exe
- Size
  
  264KB
- MD5
  
  3a8465df8b12904a5d7a38fc1b6ae300
- SHA1
  
  5a88a335d9de71dadcf1fbbfc5f25384bac0c460
- SHA256
  
  e10f1e70fa84b2d135123e72e4c46770d9f663f0c2036e3e7a4e7a3bf8cd5f96
- SHA512
  
  97a681b060301437ef9dca6867f526e3338862dc2e6ae352ca76cd46e440e250d3c6e13a7d82627d4618d63cc92e2414e451adb67abe731f78f9b86fcdfa3aae
- SSDEEP
  
  3072:NTWEhkRkN8P+1YD4HZHVNP2k627LIyewPd+jKXQO5Zs0hGV5j3jIWsei2/:NyEh5Nw4HdVe279VEcXThe53jgm
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer