db14e6863ac69e3e3f4980b8d35246a2b23fb49ba5df637f663d4e919bd86652 | Triage

Resubmissions

24/08/2023, 11:27 UTC

230824-nkwsxscb93 7

24/08/2023, 11:23 UTC

230824-nhgwzsdg2y 7

24/08/2023, 11:05 UTC

230824-m6t1sadf2s 10

Sharing

General

Target

setup.exe
Size

7.2MB
Sample

230824-m6t1sadf2s
MD5

858d793cf7b8ba4381ce447e91dd5975
SHA1

ca790bbe56d76188fcc6bf63739c770239ab0441
SHA256

db14e6863ac69e3e3f4980b8d35246a2b23fb49ba5df637f663d4e919bd86652
SHA512

d4803602a55c1c510df11ec85980b62c9ece34ccd6e9b0130cdd31cfdcd8e44a360d0043517426637c15d68a980eb2ffd6c44a2dd7343dbc6d47d4ed3c7cacc2
SSDEEP

196608:91OkDh5/O74iqo1sVqYgM/mDHFD/JXUkA1z1E+lQQlq:3OkDhFO74iF1sVD/OU1z1EJQ4

Score

10^/10

evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  setup.exe
- Size
  
  7.2MB
- MD5
  
  858d793cf7b8ba4381ce447e91dd5975
- SHA1
  
  ca790bbe56d76188fcc6bf63739c770239ab0441
- SHA256
  
  db14e6863ac69e3e3f4980b8d35246a2b23fb49ba5df637f663d4e919bd86652
- SHA512
  
  d4803602a55c1c510df11ec85980b62c9ece34ccd6e9b0130cdd31cfdcd8e44a360d0043517426637c15d68a980eb2ffd6c44a2dd7343dbc6d47d4ed3c7cacc2
- SSDEEP
  
  196608:91OkDh5/O74iqo1sVqYgM/mDHFD/JXUkA1z1E+lQQlq:3OkDhFO74iF1sVD/OU1z1EJQ4
Score

10^/10

evasion spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security bypass
  evasion trojan
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywarestealertrojan

behavioral2