fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289 | Triage

Sharing

General

Target

fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289
Size

205KB
Sample

231030-svedvafg39
MD5

8dfccea5352f1cbaa222be3a97295a04
SHA1

9fa21ee3307dbf70beef9ea2591b1296911076e6
SHA256

fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289
SHA512

fd11aee0246f6456d1994bf56d4992ee9b45f33149b625afeee7dd0d505fbf9c8cea48eb3e6c9a7836bd1e8d055bdddcd1931b2ac5bf564ce036192a82d6dbb7
SSDEEP

3072:KLe9e+ay7hlZQuV94G2mxtZZVl1dbzxtJB3Stk3MAsasMASY49b/EUe:a+ag3VlLbzxtJB3StqMBasMtF/9

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289
- Size
  
  205KB
- MD5
  
  8dfccea5352f1cbaa222be3a97295a04
- SHA1
  
  9fa21ee3307dbf70beef9ea2591b1296911076e6
- SHA256
  
  fe4431fa5399ae196c0704ba9fd17c537c17fa10d3ab1f03de93b14187366289
- SHA512
  
  fd11aee0246f6456d1994bf56d4992ee9b45f33149b625afeee7dd0d505fbf9c8cea48eb3e6c9a7836bd1e8d055bdddcd1931b2ac5bf564ce036192a82d6dbb7
- SSDEEP
  
  3072:KLe9e+ay7hlZQuV94G2mxtZZVl1dbzxtJB3Stk3MAsasMASY49b/EUe:a+ag3VlLbzxtJB3StqMBasMtF/9
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2