2bbf3c221efddca4e08f858a49fc3fcb30a926ab0fd891ed49b5a1b911c0aa7a | Triage

Sharing

General

Target

NEAS.aa96cff014688320aaa89eae10590653.exe
Size

499KB
Sample

231111-nrb24aef2x
MD5

aa96cff014688320aaa89eae10590653
SHA1

f9ea1e9340491167ec5f6548bdc3b4efa6bd0f44
SHA256

2bbf3c221efddca4e08f858a49fc3fcb30a926ab0fd891ed49b5a1b911c0aa7a
SHA512

64303d20888f7104e44a36de4419a682280d10180eff5967a0a2cad985033d5915382d5fbfe950fbad295bdc293ae63e7189fa77483f5852c81430fbd9d938d4
SSDEEP

12288:A//vi9BcMviUi5ArtSG32IvWwKSXbf8tROUGFUreYpaXAu1f798nX8m:2w8W0GGvwKSXr22EBginXV

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  NEAS.aa96cff014688320aaa89eae10590653.exe
- Size
  
  499KB
- MD5
  
  aa96cff014688320aaa89eae10590653
- SHA1
  
  f9ea1e9340491167ec5f6548bdc3b4efa6bd0f44
- SHA256
  
  2bbf3c221efddca4e08f858a49fc3fcb30a926ab0fd891ed49b5a1b911c0aa7a
- SHA512
  
  64303d20888f7104e44a36de4419a682280d10180eff5967a0a2cad985033d5915382d5fbfe950fbad295bdc293ae63e7189fa77483f5852c81430fbd9d938d4
- SSDEEP
  
  12288:A//vi9BcMviUi5ArtSG32IvWwKSXbf8tROUGFUreYpaXAu1f798nX8m:2w8W0GGvwKSXr22EBginXV
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2