7e79a0c950f0086ebed76cde6bd4dc6853354461ae03eaf8cda53e2350226a0c | Triage

Sharing

General

Target

0358a5e6cd355452c2ba03bf34647939
Size

314KB
Sample

231225-d4ryzabagj
MD5

0358a5e6cd355452c2ba03bf34647939
SHA1

5c71dbf54a9e6ba1237bea6aa04a0f3f04dd6a61
SHA256

7e79a0c950f0086ebed76cde6bd4dc6853354461ae03eaf8cda53e2350226a0c
SHA512

2e4ac3b428b28d466800065904f3d0ea0e4eb3f390590d5d1ec44e6544b07592fab71cd93ea2e4639161afa273faf95e4ba4161af0627797e9c3277b309b41c4
SSDEEP

6144:hTOGiA9k6j6AvSHlFYlfNad5+LKh086tMhadfWx65vP59c1:N1zvSFMNBKh0xtI+f1t59W

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  0358a5e6cd355452c2ba03bf34647939
- Size
  
  314KB
- MD5
  
  0358a5e6cd355452c2ba03bf34647939
- SHA1
  
  5c71dbf54a9e6ba1237bea6aa04a0f3f04dd6a61
- SHA256
  
  7e79a0c950f0086ebed76cde6bd4dc6853354461ae03eaf8cda53e2350226a0c
- SHA512
  
  2e4ac3b428b28d466800065904f3d0ea0e4eb3f390590d5d1ec44e6544b07592fab71cd93ea2e4639161afa273faf95e4ba4161af0627797e9c3277b309b41c4
- SSDEEP
  
  6144:hTOGiA9k6j6AvSHlFYlfNad5+LKh086tMhadfWx65vP59c1:N1zvSFMNBKh0xtI+f1t59W
Score

7^/10

spyware stealer
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2