7815c3f6bd6f4ab1a177e1c61036c58037a8230eb26971e1f9da4899e9eee716 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d570c328af241cb7f0f2d2a0aa95906
Size

819KB
Sample

240109-e5b5ksfebk
MD5

4d570c328af241cb7f0f2d2a0aa95906
SHA1

2ff1bf02afa8ec101439d5e7946848a7b0364d2c
SHA256

7815c3f6bd6f4ab1a177e1c61036c58037a8230eb26971e1f9da4899e9eee716
SHA512

3014dbfe5421e06a92b44dcdda403180e8811d1ecaaacb42d32b4a46d91a88e8bc83b4760f7e9d243c60004152064160d4ce74b8b9ad40bd573041fa72baa784
SSDEEP

12288:VCe0uqnMQQp6KdUxQLszfDzCMssy4dO5BxeXV48e+Tp26tZQwJyiHVHl/:VD0uqnMjp6Kdp+fiI6xea8e6vFb

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  4d570c328af241cb7f0f2d2a0aa95906
- Size
  
  819KB
- MD5
  
  4d570c328af241cb7f0f2d2a0aa95906
- SHA1
  
  2ff1bf02afa8ec101439d5e7946848a7b0364d2c
- SHA256
  
  7815c3f6bd6f4ab1a177e1c61036c58037a8230eb26971e1f9da4899e9eee716
- SHA512
  
  3014dbfe5421e06a92b44dcdda403180e8811d1ecaaacb42d32b4a46d91a88e8bc83b4760f7e9d243c60004152064160d4ce74b8b9ad40bd573041fa72baa784
- SSDEEP
  
  12288:VCe0uqnMQQp6KdUxQLszfDzCMssy4dO5BxeXV48e+Tp26tZQwJyiHVHl/:VD0uqnMjp6Kdp+fiI6xea8e6vFb
Score

7^/10

discovery persistence spyware stealer upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2