81f6200687b7e2a44192b974bc449d1e02cb1b740ffcf01e299efa0d52f4d63c | Triage

Sharing

General

Target

81f6200687b7e2a44192b974bc449d1e02cb1b740ffcf01e299efa0d52f4d63c
Size

25KB
Sample

231014-bfy19sag54
MD5

5115ffcb7e417a54280cf874605c8b2e
SHA1

5cd4640a58e1cc131d4b95f5a6956fdd3f8e5aed
SHA256

81f6200687b7e2a44192b974bc449d1e02cb1b740ffcf01e299efa0d52f4d63c
SHA512

de4934ea2c282186178c4385e37ed3476ae4bf4cc5e7fc84432016c82fdf974b0ecb7ac0560d48f5ba19f99438681d533ba626b113e732d822299c8c42bfdaf7
SSDEEP

384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvq:8Q3LotOPNSQVwVVxGKEvKHrVq

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  81f6200687b7e2a44192b974bc449d1e02cb1b740ffcf01e299efa0d52f4d63c
- Size
  
  25KB
- MD5
  
  5115ffcb7e417a54280cf874605c8b2e
- SHA1
  
  5cd4640a58e1cc131d4b95f5a6956fdd3f8e5aed
- SHA256
  
  81f6200687b7e2a44192b974bc449d1e02cb1b740ffcf01e299efa0d52f4d63c
- SHA512
  
  de4934ea2c282186178c4385e37ed3476ae4bf4cc5e7fc84432016c82fdf974b0ecb7ac0560d48f5ba19f99438681d533ba626b113e732d822299c8c42bfdaf7
- SSDEEP
  
  384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvq:8Q3LotOPNSQVwVVxGKEvKHrVq
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer