08aa02144c8b48aa7b1f94a3508472f3281b5bbb908cab49596f8ed9c3d20000 | Triage

Sharing

General

Target

NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
Size

1.2MB
Sample

231016-wywzvada9x
MD5

4d91c02d2852b989865a35bf7548d7e0
SHA1

0b44e7553b7cb97cb0ebd9713bc8c131db3aae84
SHA256

08aa02144c8b48aa7b1f94a3508472f3281b5bbb908cab49596f8ed9c3d20000
SHA512

d6e4525aa62ac88a869265846e738f8681df3f93636109c3b6bd6f19f9bf85e2bcd74c238a889cdf09a77a0abc67ec5ffc971c89e7c386e7a07ce02bdd75c3b3
SSDEEP

24576:oWDvFI0+yQUVB7ppk7dH8RwVI/TOFowVitm3VvKAk:VLF33pWRGwiLOFT6Cl6

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
- Size
  
  1.2MB
- MD5
  
  4d91c02d2852b989865a35bf7548d7e0
- SHA1
  
  0b44e7553b7cb97cb0ebd9713bc8c131db3aae84
- SHA256
  
  08aa02144c8b48aa7b1f94a3508472f3281b5bbb908cab49596f8ed9c3d20000
- SHA512
  
  d6e4525aa62ac88a869265846e738f8681df3f93636109c3b6bd6f19f9bf85e2bcd74c238a889cdf09a77a0abc67ec5ffc971c89e7c386e7a07ce02bdd75c3b3
- SSDEEP
  
  24576:oWDvFI0+yQUVB7ppk7dH8RwVI/TOFowVitm3VvKAk:VLF33pWRGwiLOFT6Cl6
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

persistencespywarestealer