be22d5ff9e0e3617691e86e25bd7c48259704d575449be9d402eb5ec3b385002 | Triage

Sharing

General

Target

be22d5ff9e0e3617691e86e25bd7c48259704d575449be9d402eb5ec3b385002
Size

25KB
Sample

231009-qm1k1ada7x
MD5

989a6d4c1f7ad0403c4ad22f14c8c30a
SHA1

ecf513422851a5aeaff4c675bc7112a1fd307b19
SHA256

be22d5ff9e0e3617691e86e25bd7c48259704d575449be9d402eb5ec3b385002
SHA512

941e2403e75d8d090d77eeb19f5bc3f40a606c6e8450657211083edbf966bb6e0e187d36bb5c0988faa016dd87b4a3dc43d526aee1ba950f4bbd65cb411648dd
SSDEEP

384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvI:8Q3LotOPNSQVwVVxGKEvKHrVI

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  be22d5ff9e0e3617691e86e25bd7c48259704d575449be9d402eb5ec3b385002
- Size
  
  25KB
- MD5
  
  989a6d4c1f7ad0403c4ad22f14c8c30a
- SHA1
  
  ecf513422851a5aeaff4c675bc7112a1fd307b19
- SHA256
  
  be22d5ff9e0e3617691e86e25bd7c48259704d575449be9d402eb5ec3b385002
- SHA512
  
  941e2403e75d8d090d77eeb19f5bc3f40a606c6e8450657211083edbf966bb6e0e187d36bb5c0988faa016dd87b4a3dc43d526aee1ba950f4bbd65cb411648dd
- SSDEEP
  
  384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvI:8Q3LotOPNSQVwVVxGKEvKHrVI
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer