ed5982dd32316b2d16f0490c633ee43f3c0d6b62207dc8351d63b07d9a27d532 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed5982dd32316b2d16f0490c633ee43f3c0d6b62207dc8351d63b07d9a27d532
Size

903KB
Sample

231003-f1hx1agd6t
MD5

9af28b16ea32b7f590b7c8e18babbe84
SHA1

61768d397ada67b94871892a147ccbdfbfc25313
SHA256

ed5982dd32316b2d16f0490c633ee43f3c0d6b62207dc8351d63b07d9a27d532
SHA512

f32ebc40dff756f0cb33051df717e7ad982a2771500425156e22570e35bbaa21e8794273a48fb940aa7640fd560d7b0d6c1e65722348dd096240ed16df389291
SSDEEP

24576:8BHlabsM8KGH7Co0OLeGrIocE5lArjPP:8BHl08KGbNLeGMb4un

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  ed5982dd32316b2d16f0490c633ee43f3c0d6b62207dc8351d63b07d9a27d532
- Size
  
  903KB
- MD5
  
  9af28b16ea32b7f590b7c8e18babbe84
- SHA1
  
  61768d397ada67b94871892a147ccbdfbfc25313
- SHA256
  
  ed5982dd32316b2d16f0490c633ee43f3c0d6b62207dc8351d63b07d9a27d532
- SHA512
  
  f32ebc40dff756f0cb33051df717e7ad982a2771500425156e22570e35bbaa21e8794273a48fb940aa7640fd560d7b0d6c1e65722348dd096240ed16df389291
- SSDEEP
  
  24576:8BHlabsM8KGH7Co0OLeGrIocE5lArjPP:8BHl08KGbNLeGMb4un
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2