1b24c1da96bcd5a3cd5ec12aeb4c831f153544aba7b446812d8405995088a8f7 | Triage

Sharing

General

Target

0d623bce1856f20ed0feebffc982d661
Size

803KB
Sample

231225-ht1kkshfhj
MD5

0d623bce1856f20ed0feebffc982d661
SHA1

e57acd827370b7c126e1fa2d98d4d6bdbc3d7b55
SHA256

1b24c1da96bcd5a3cd5ec12aeb4c831f153544aba7b446812d8405995088a8f7
SHA512

9445589c2d4847390b928bb497d0bb0ed110214682d6dea9bc91ba56c85cc9f0b5cc12f60c8070f2fc9cfb2032dd1e06f5ba9dba83f8ea03beba6ccf82f852e5
SSDEEP

12288:HEOMajtYag2ae+Rvv/S7w2eDrL4gHotqMVCO/qkc09W9jrSBfJnrhnOTOnji:zMaj1g2M9aoLlotlCOBuHwJrhnOTZ

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  0d623bce1856f20ed0feebffc982d661
- Size
  
  803KB
- MD5
  
  0d623bce1856f20ed0feebffc982d661
- SHA1
  
  e57acd827370b7c126e1fa2d98d4d6bdbc3d7b55
- SHA256
  
  1b24c1da96bcd5a3cd5ec12aeb4c831f153544aba7b446812d8405995088a8f7
- SHA512
  
  9445589c2d4847390b928bb497d0bb0ed110214682d6dea9bc91ba56c85cc9f0b5cc12f60c8070f2fc9cfb2032dd1e06f5ba9dba83f8ea03beba6ccf82f852e5
- SSDEEP
  
  12288:HEOMajtYag2ae+Rvv/S7w2eDrL4gHotqMVCO/qkc09W9jrSBfJnrhnOTOnji:zMaj1g2M9aoLlotlCOBuHwJrhnOTZ
Score

7^/10

discovery persistence spyware stealer upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2