2716768423878309c0796b0de66fb9ae63d78ef0a043e69d3708832be04b4c26 | Triage

Sharing

General

Target

3bba813ba5e9e0e41e16ca35b3f1931c
Size

6.5MB
Sample

240101-dmgfxadcc9
MD5

3bba813ba5e9e0e41e16ca35b3f1931c
SHA1

4f6fb92c527e7fa05a08e20192951ff5edca250d
SHA256

2716768423878309c0796b0de66fb9ae63d78ef0a043e69d3708832be04b4c26
SHA512

dc8ab81f60387dcdc5d737e57fa1df2615308c3749c8d53199ef6a5e702b2eade0a1513deb63f490bee48970b964d5223b08929f05754450e06074e69ddc14aa
SSDEEP

196608:78JPmCsXDjDyf6L2WliXYrHW1LShKSapR:sPmCEDVL2ciIrHWRShKp

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  3bba813ba5e9e0e41e16ca35b3f1931c
- Size
  
  6.5MB
- MD5
  
  3bba813ba5e9e0e41e16ca35b3f1931c
- SHA1
  
  4f6fb92c527e7fa05a08e20192951ff5edca250d
- SHA256
  
  2716768423878309c0796b0de66fb9ae63d78ef0a043e69d3708832be04b4c26
- SHA512
  
  dc8ab81f60387dcdc5d737e57fa1df2615308c3749c8d53199ef6a5e702b2eade0a1513deb63f490bee48970b964d5223b08929f05754450e06074e69ddc14aa
- SSDEEP
  
  196608:78JPmCsXDjDyf6L2WliXYrHW1LShKSapR:sPmCEDVL2ciIrHWRShKp
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2