7803231efa286e0d95f94374100bbabf0ccb787223356c15e12e584d5c698265 | Triage

Sharing

General

Target

7803231efa286e0d95f94374100bbabf0ccb787223356c15e12e584d5c698265
Size

2.6MB
Sample

231223-m3b1ssehcj
MD5

fa6d7eb4df4e2dbd1816175fbcdade02
SHA1

da27692c4eecc851f4e4208157e7cdcaaad7d090
SHA256

7803231efa286e0d95f94374100bbabf0ccb787223356c15e12e584d5c698265
SHA512

5724d1508c57d4e1d17c33e1d020794e9ba478c563b5a140c494ea5066b8c4a7d1b58a889a6c74d5fa741e8d01b68629b80d15c4c0a66f83602d9223a71e03e3
SSDEEP

49152:gA81IJP0qnEvdDqnroHOfmlO2tiToyGxgMHO:gA81ItgcnsHOm46iToyslH

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  7803231efa286e0d95f94374100bbabf0ccb787223356c15e12e584d5c698265
- Size
  
  2.6MB
- MD5
  
  fa6d7eb4df4e2dbd1816175fbcdade02
- SHA1
  
  da27692c4eecc851f4e4208157e7cdcaaad7d090
- SHA256
  
  7803231efa286e0d95f94374100bbabf0ccb787223356c15e12e584d5c698265
- SHA512
  
  5724d1508c57d4e1d17c33e1d020794e9ba478c563b5a140c494ea5066b8c4a7d1b58a889a6c74d5fa741e8d01b68629b80d15c4c0a66f83602d9223a71e03e3
- SSDEEP
  
  49152:gA81IJP0qnEvdDqnroHOfmlO2tiToyGxgMHO:gA81ItgcnsHOm46iToyslH
Score

8^/10

discovery spyware stealer
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer