b760fd1b8d86af6b67ac24e6a269f2ffbc818d37f7930fb562cce1331213d031 | Triage

Sharing

General

Target

file.exe
Size

250KB
Sample

231115-3c4k5aee59
MD5

af3b051d8a6a33705bd095b6d5608355
SHA1

5d40bc70952705708d9bd87f1057e3e05d941b68
SHA256

b760fd1b8d86af6b67ac24e6a269f2ffbc818d37f7930fb562cce1331213d031
SHA512

7ed56d5ff9148b891894acb096b400623ac45e5913bd3a10e0462dc8ed93b49e43ebb51b2b0b851a16f867ff9f30922f1c5c6ed1b6c467e197f96999fc50d77f
SSDEEP

3072:lNL7jL+5ScekHLTlZGTfobBKgJLR2ghco9CR:XPL+ocFHPlZGQKpi

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  250KB
- MD5
  
  af3b051d8a6a33705bd095b6d5608355
- SHA1
  
  5d40bc70952705708d9bd87f1057e3e05d941b68
- SHA256
  
  b760fd1b8d86af6b67ac24e6a269f2ffbc818d37f7930fb562cce1331213d031
- SHA512
  
  7ed56d5ff9148b891894acb096b400623ac45e5913bd3a10e0462dc8ed93b49e43ebb51b2b0b851a16f867ff9f30922f1c5c6ed1b6c467e197f96999fc50d77f
- SSDEEP
  
  3072:lNL7jL+5ScekHLTlZGTfobBKgJLR2ghco9CR:XPL+ocFHPlZGQKpi
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2