b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e | Triage

Sharing

General

Target

b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e
Size

1.1MB
Sample

230804-a6dycahh8s
MD5

a490f1848b792df4dc37c9e1b200578d
SHA1

f862b1f3460aafd54b1159b2a180f70e6b3d8d21
SHA256

b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e
SHA512

1e9a492976d2c80acd7cebfa8ca8fba55c3a9cb71ecf12a5c29e648f6fcc0d9d41930a33964c6b85ecbc96150a25dcc08578da5d2e0dd509d370256d4d20f268
SSDEEP

24576:mDXdMCbh0lhSMXlPFN3RFEuHhra2oQfKhBdY7O8gz/7:mBMPt/G29fKhBdYy8ij

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e
- Size
  
  1.1MB
- MD5
  
  a490f1848b792df4dc37c9e1b200578d
- SHA1
  
  f862b1f3460aafd54b1159b2a180f70e6b3d8d21
- SHA256
  
  b61325a676000c0afb169f63048c583bc81cb52e1690a6ccf5642decb7831b5e
- SHA512
  
  1e9a492976d2c80acd7cebfa8ca8fba55c3a9cb71ecf12a5c29e648f6fcc0d9d41930a33964c6b85ecbc96150a25dcc08578da5d2e0dd509d370256d4d20f268
- SSDEEP
  
  24576:mDXdMCbh0lhSMXlPFN3RFEuHhra2oQfKhBdY7O8gz/7:mBMPt/G29fKhBdYy8ij
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1