b306d7aa81bba32e0d51a441f5be19fb71f3d639bfe75127017b2c42ca548d49 | Triage

Sharing

General

Target

b306d7aa81bba32e0d51a441f5be19fb71f3d639bfe75127017b2c42ca548d49
Size

25KB
Sample

231012-nlvx1shg49
MD5

808149036ca2c8fc70b1eab88d355c16
SHA1

a08f00e5d92ad7d39eff8a021693edeaea8759b1
SHA256

b306d7aa81bba32e0d51a441f5be19fb71f3d639bfe75127017b2c42ca548d49
SHA512

cb9a48b9412ec13fa1c0d5c89e90f37274cef88cde1acd0bb21b223b3ae879c7ed13488a56fef0d0695f450f2ff95c0c0b0212b9265b30e2ac02174a38246470
SSDEEP

384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvXgq:8Q3LotOPNSQVwVVxGKEvKHrVXb

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  b306d7aa81bba32e0d51a441f5be19fb71f3d639bfe75127017b2c42ca548d49
- Size
  
  25KB
- MD5
  
  808149036ca2c8fc70b1eab88d355c16
- SHA1
  
  a08f00e5d92ad7d39eff8a021693edeaea8759b1
- SHA256
  
  b306d7aa81bba32e0d51a441f5be19fb71f3d639bfe75127017b2c42ca548d49
- SHA512
  
  cb9a48b9412ec13fa1c0d5c89e90f37274cef88cde1acd0bb21b223b3ae879c7ed13488a56fef0d0695f450f2ff95c0c0b0212b9265b30e2ac02174a38246470
- SSDEEP
  
  384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvXgq:8Q3LotOPNSQVwVVxGKEvKHrVXb
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer