923b6784a84b222e0ea34b693a74d4739a2694543fc8d8db6022eb8bc27abdf4 | Triage

Sharing

General

Target

236d9f4f6a605420bfd61748bb1892ee
Size

274KB
Sample

231219-pqsh5aedc7
MD5

236d9f4f6a605420bfd61748bb1892ee
SHA1

14efe75f75e9219cf1b1e912c25ed41cebf4927a
SHA256

923b6784a84b222e0ea34b693a74d4739a2694543fc8d8db6022eb8bc27abdf4
SHA512

1e9ebf68740ad0e54be200885ab0691223a89049c5472dd435a35ec85b9fd748e00ca9cfdf308b00c0ec5614002ffbb635cc11e8a55e05f312c8851cfdb98da5
SSDEEP

6144:BhXawgIT1Ql7rm2zKxbEFhY2y5eMDkgKk3BFBRlKVA:B85t7rmsKxbE7gTDkPorBRT

Score

7^/10

persistence spyware stealer upx

Malware Config

Targets

- Target
  
  236d9f4f6a605420bfd61748bb1892ee
- Size
  
  274KB
- MD5
  
  236d9f4f6a605420bfd61748bb1892ee
- SHA1
  
  14efe75f75e9219cf1b1e912c25ed41cebf4927a
- SHA256
  
  923b6784a84b222e0ea34b693a74d4739a2694543fc8d8db6022eb8bc27abdf4
- SHA512
  
  1e9ebf68740ad0e54be200885ab0691223a89049c5472dd435a35ec85b9fd748e00ca9cfdf308b00c0ec5614002ffbb635cc11e8a55e05f312c8851cfdb98da5
- SSDEEP
  
  6144:BhXawgIT1Ql7rm2zKxbEFhY2y5eMDkgKk3BFBRlKVA:B85t7rmsKxbE7gTDkPorBRT
Score

7^/10

persistence spyware stealer upx
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealerupx

behavioral2