cd572457794b978a8bb60dd7e39f560aed4ecfeabaf4ab924cbf08a89e8ecd49 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cd572457794b978a8bb60dd7e39f560aed4ecfeabaf4ab924cbf08a89e8ecd49
Size

12KB
Sample

231009-rqch1sdd21
MD5

1de8eae499ed8c3c3671147b926257e1
SHA1

669f820a761f68850d21bbf2d1cb3dfe00bcb7af
SHA256

cd572457794b978a8bb60dd7e39f560aed4ecfeabaf4ab924cbf08a89e8ecd49
SHA512

7ac2291540739bd3490fd24d280aef2cc252f49ca07b0aab91d5b1690d8d8b703387cf00558e7159a8695b4775bb8fcc875a71e0082f0ef6aa37b1017b094aed
SSDEEP

192:FmS1Xdn5wLpYXQEuS7wyEPQO0llY3Dvz0EoNH6TnF5tY+gH:JvnuVYgvYOr3boEiH0Ps

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  cd572457794b978a8bb60dd7e39f560aed4ecfeabaf4ab924cbf08a89e8ecd49
- Size
  
  12KB
- MD5
  
  1de8eae499ed8c3c3671147b926257e1
- SHA1
  
  669f820a761f68850d21bbf2d1cb3dfe00bcb7af
- SHA256
  
  cd572457794b978a8bb60dd7e39f560aed4ecfeabaf4ab924cbf08a89e8ecd49
- SHA512
  
  7ac2291540739bd3490fd24d280aef2cc252f49ca07b0aab91d5b1690d8d8b703387cf00558e7159a8695b4775bb8fcc875a71e0082f0ef6aa37b1017b094aed
- SSDEEP
  
  192:FmS1Xdn5wLpYXQEuS7wyEPQO0llY3Dvz0EoNH6TnF5tY+gH:JvnuVYgvYOr3boEiH0Ps
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer