9fb22d4e510076f988890e3fa2b1183590460db7883d0801c97474678e65235f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9fb22d4e510076f988890e3fa2b1183590460db7883d0801c97474678e65235f
Size

66KB
Sample

240221-s6g9waah25
MD5

0fd211f7c516c7c052d16e7c1bb844e6
SHA1

32e98364a79353dff15f0b2d8480de8a57b32147
SHA256

9fb22d4e510076f988890e3fa2b1183590460db7883d0801c97474678e65235f
SHA512

625ef1db987aa37b6d2cfbf7d893b0b4744f8d5ad99abf4135cb5638e835b3f878345a5e9aa6d24a161f8dfcafad7cc00bf4942d9c76ca872829693f600643c9
SSDEEP

768:cZMrKKuk+Vxr1x5A0VDrPzJ88O5p+9ogqSahkwA4YFAU52KG6KzVSVxhMXYkUEt8:cAsxN92ppTSahtA3AK2kKzs2Irj5hN

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  9fb22d4e510076f988890e3fa2b1183590460db7883d0801c97474678e65235f
- Size
  
  66KB
- MD5
  
  0fd211f7c516c7c052d16e7c1bb844e6
- SHA1
  
  32e98364a79353dff15f0b2d8480de8a57b32147
- SHA256
  
  9fb22d4e510076f988890e3fa2b1183590460db7883d0801c97474678e65235f
- SHA512
  
  625ef1db987aa37b6d2cfbf7d893b0b4744f8d5ad99abf4135cb5638e835b3f878345a5e9aa6d24a161f8dfcafad7cc00bf4942d9c76ca872829693f600643c9
- SSDEEP
  
  768:cZMrKKuk+Vxr1x5A0VDrPzJ88O5p+9ogqSahkwA4YFAU52KG6KzVSVxhMXYkUEt8:cAsxN92ppTSahtA3AK2kKzs2Irj5hN
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2