5b0d0d6d01b25c6c7af20da0a3c5256ffd61d439c19dd1a22b1b9b67882b3cd0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

updater.exe
Size

62.0MB
Sample

231125-xwwrqscb82
MD5

2ef140966b38a9c3025a123423e36667
SHA1

411ef2d704a59446f52d36805945f13ea30105bb
SHA256

5b0d0d6d01b25c6c7af20da0a3c5256ffd61d439c19dd1a22b1b9b67882b3cd0
SHA512

54ef9b176796fe4704e6dfb60ddff2051dc699d2b3100841e29439006df5fcc1cd01f498fabebe385288bf097857fa2c78b5b41337b356fbe55fa76bd6bcee88
SSDEEP

786432:havhX/O6oxkolqMF/0OWCKHOgCcqcKLdpymtNMk7DcpZpiJRy2RIFjUZlQiRX3cY:Im6ekoEMF/cHPMNMLpZyIdiBcQ60EmJ

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  updater.exe
- Size
  
  62.0MB
- MD5
  
  2ef140966b38a9c3025a123423e36667
- SHA1
  
  411ef2d704a59446f52d36805945f13ea30105bb
- SHA256
  
  5b0d0d6d01b25c6c7af20da0a3c5256ffd61d439c19dd1a22b1b9b67882b3cd0
- SHA512
  
  54ef9b176796fe4704e6dfb60ddff2051dc699d2b3100841e29439006df5fcc1cd01f498fabebe385288bf097857fa2c78b5b41337b356fbe55fa76bd6bcee88
- SSDEEP
  
  786432:havhX/O6oxkolqMF/0OWCKHOgCcqcKLdpymtNMk7DcpZpiJRy2RIFjUZlQiRX3cY:Im6ekoEMF/cHPMNMLpZyIdiBcQ60EmJ
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2