5e49ab8fc5ff67a3e4a8fa296e428d95fe19f868367b1ab3b9fd837a6c7d98c4 | Triage

Sharing

General

Target

5e49ab8fc5ff67a3e4a8fa296e428d95fe19f868367b1ab3b9fd837a6c7d98c4
Size

817KB
Sample

230830-dw63xshe24
MD5

a1ad8b7961ff0cd54e59af81abdb24fb
SHA1

a07df462d0c29c0bbcc5d4165a8676010da9c4a6
SHA256

5e49ab8fc5ff67a3e4a8fa296e428d95fe19f868367b1ab3b9fd837a6c7d98c4
SHA512

8dcbae212bf1a2bdbc200454fef24bbc5b5c7fa726be77215ee8219fa4fb557ec3d89772efb79aa9401d807e007809d76c152dca4ce3be9acdf2b67aa9ddacf5
SSDEEP

12288:EAPc/z15+35scLm5OKzV2jb74Eb/NoKVABtg4VXa5du5mPkBseFf2NWQVgEz8wo:EDr2Om4ERiVXaTDieNWQVDowo

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  5e49ab8fc5ff67a3e4a8fa296e428d95fe19f868367b1ab3b9fd837a6c7d98c4
- Size
  
  817KB
- MD5
  
  a1ad8b7961ff0cd54e59af81abdb24fb
- SHA1
  
  a07df462d0c29c0bbcc5d4165a8676010da9c4a6
- SHA256
  
  5e49ab8fc5ff67a3e4a8fa296e428d95fe19f868367b1ab3b9fd837a6c7d98c4
- SHA512
  
  8dcbae212bf1a2bdbc200454fef24bbc5b5c7fa726be77215ee8219fa4fb557ec3d89772efb79aa9401d807e007809d76c152dca4ce3be9acdf2b67aa9ddacf5
- SSDEEP
  
  12288:EAPc/z15+35scLm5OKzV2jb74Eb/NoKVABtg4VXa5du5mPkBseFf2NWQVgEz8wo:EDr2Om4ERiVXaTDieNWQVDowo
Score

8^/10

spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1