ece88b37ce9ccb5b647eebf83295b88e50d52f95e4e3d74b37bd6ee7c144a4d4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e46044fd76211410feb4624789608e2_JC.exe
Size

477KB
Sample

231011-rd7hmadg64
MD5

2e46044fd76211410feb4624789608e2
SHA1

af8821149c5dd86ae7abf405546f91530cf4f38a
SHA256

ece88b37ce9ccb5b647eebf83295b88e50d52f95e4e3d74b37bd6ee7c144a4d4
SHA512

e2c5700ce127d6d285a9149eb8527eabd48176d0eab2b613c4ced3c9755cdbb1929ff653c9d10b368328a60bf051692161474d3389a059825411a2ccf0078739
SSDEEP

12288:lXa8s57SdUGe3x3Foavz0RdJS1cdLR8byiwKYlys:lq8oD3xFr0Rjg+AybK2X

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  2e46044fd76211410feb4624789608e2_JC.exe
- Size
  
  477KB
- MD5
  
  2e46044fd76211410feb4624789608e2
- SHA1
  
  af8821149c5dd86ae7abf405546f91530cf4f38a
- SHA256
  
  ece88b37ce9ccb5b647eebf83295b88e50d52f95e4e3d74b37bd6ee7c144a4d4
- SHA512
  
  e2c5700ce127d6d285a9149eb8527eabd48176d0eab2b613c4ced3c9755cdbb1929ff653c9d10b368328a60bf051692161474d3389a059825411a2ccf0078739
- SSDEEP
  
  12288:lXa8s57SdUGe3x3Foavz0RdJS1cdLR8byiwKYlys:lq8oD3xFr0Rjg+AybK2X
Score

7^/10

persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2