6f27472247fac75c31c76aedb7823da8429aef16f26d5ab27721686e924cde94 | Triage

Sharing

General

Target

50c2d68b67e63e9e58170740ba2380a3.bin
Size

14.3MB
Sample

231220-clrptabag3
MD5

50c2d68b67e63e9e58170740ba2380a3
SHA1

31ca0875a886a87e7f756816a5a3a8a9f0ef4805
SHA256

6f27472247fac75c31c76aedb7823da8429aef16f26d5ab27721686e924cde94
SHA512

6e3ce56f24eac510022716c69ccbd7a1332373b95568b5d985172a7197db8965dc8faccbe91a0be822e62c01adac49f6955c9e86128d8597536bd845a7770306
SSDEEP

196608:OvmwHVRzpgetATsTJbaAzgLPz+hgtrxro+QpqN/+BL5fNWJ+BSNLuk7GFViAk0He:OZ1lATstzYPttroBa+lq+4tUVxFE

Score

9^/10

evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  50c2d68b67e63e9e58170740ba2380a3.bin
- Size
  
  14.3MB
- MD5
  
  50c2d68b67e63e9e58170740ba2380a3
- SHA1
  
  31ca0875a886a87e7f756816a5a3a8a9f0ef4805
- SHA256
  
  6f27472247fac75c31c76aedb7823da8429aef16f26d5ab27721686e924cde94
- SHA512
  
  6e3ce56f24eac510022716c69ccbd7a1332373b95568b5d985172a7197db8965dc8faccbe91a0be822e62c01adac49f6955c9e86128d8597536bd845a7770306
- SSDEEP
  
  196608:OvmwHVRzpgetATsTJbaAzgLPz+hgtrxro+QpqN/+BL5fNWJ+BSNLuk7GFViAk0He:OZ1lATstzYPttroBa+lq+4tUVxFE
Score

9^/10

evasion trojan spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionspywarestealertrojan