0d0ef361ecfab91d0c2b9ee60d0971d4f755b7bd041f9351d06dd312b6b6761c | Triage

Sharing

General

Target

NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
Size

399KB
Sample

231102-typjnafa6z
MD5

2beaa9b90baea56ab1a36677099a70c0
SHA1

1223afed4bc1588d1115e4d859eaa796ee76491f
SHA256

0d0ef361ecfab91d0c2b9ee60d0971d4f755b7bd041f9351d06dd312b6b6761c
SHA512

6fb2dfebde43be6f33bd51d0bf3a48fb95c283298d6cfc7c4659bbb2bcc67665c60c7bc19c5940ee59c41c5482ce8d50f527d6e71eec8dc0f118c3fc55806c37
SSDEEP

6144:dXC4vgmhbIxs3NBR6Eg3ZFzd7Y9/fLoJM8EmfaRl2eCRA1NIFHcx4whn5EOzhRLL:dXCNi9BgdzabMA8eCRWQGZ5EONRcc

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
- Size
  
  399KB
- MD5
  
  2beaa9b90baea56ab1a36677099a70c0
- SHA1
  
  1223afed4bc1588d1115e4d859eaa796ee76491f
- SHA256
  
  0d0ef361ecfab91d0c2b9ee60d0971d4f755b7bd041f9351d06dd312b6b6761c
- SHA512
  
  6fb2dfebde43be6f33bd51d0bf3a48fb95c283298d6cfc7c4659bbb2bcc67665c60c7bc19c5940ee59c41c5482ce8d50f527d6e71eec8dc0f118c3fc55806c37
- SSDEEP
  
  6144:dXC4vgmhbIxs3NBR6Eg3ZFzd7Y9/fLoJM8EmfaRl2eCRA1NIFHcx4whn5EOzhRLL:dXCNi9BgdzabMA8eCRWQGZ5EONRcc
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2