99eefafcf5119e40e6c9e5b50d6991b3c2658bb487f1e65f0009d35360d06363 | Triage

Sharing

General

Target

99eefafcf5119e40e6c9e5b50d6991b3c2658bb487f1e65f0009d35360d06363
Size

25KB
Sample

230827-zlyvfsfa7w
MD5

128339ccdffd5f13b5f2b504459cd47e
SHA1

19ade7065e098d044315d69816d5ee90bc55acca
SHA256

99eefafcf5119e40e6c9e5b50d6991b3c2658bb487f1e65f0009d35360d06363
SHA512

073f5d3e1a9cc0d7757e5a8f094bc6a1230d66787a940d219dda231fde1ae64e308b9ecb5395124877668cdca9164f77878f9a1409f2db3d69d2870bf301476a
SSDEEP

384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvN0m:8Q3LotOPNSQVwVVxGKEvKHrV+m

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  99eefafcf5119e40e6c9e5b50d6991b3c2658bb487f1e65f0009d35360d06363
- Size
  
  25KB
- MD5
  
  128339ccdffd5f13b5f2b504459cd47e
- SHA1
  
  19ade7065e098d044315d69816d5ee90bc55acca
- SHA256
  
  99eefafcf5119e40e6c9e5b50d6991b3c2658bb487f1e65f0009d35360d06363
- SHA512
  
  073f5d3e1a9cc0d7757e5a8f094bc6a1230d66787a940d219dda231fde1ae64e308b9ecb5395124877668cdca9164f77878f9a1409f2db3d69d2870bf301476a
- SSDEEP
  
  384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvN0m:8Q3LotOPNSQVwVVxGKEvKHrV+m
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer