8f7074c17844d70b1da84771256367d3d088f0d039ee7758475d9bba09b461c5 | Triage

Sharing

General

Target

d4a9a0f90082268ebe5b0ecb8c0d8844
Size

139KB
Sample

240318-3ppmqsbg72
MD5

d4a9a0f90082268ebe5b0ecb8c0d8844
SHA1

f75c068a1849b43ad7aa78a908ddc6b5fc14285f
SHA256

8f7074c17844d70b1da84771256367d3d088f0d039ee7758475d9bba09b461c5
SHA512

23be1c3265ed8d4d6c95bdda1c7114ffc0fd1a5501c4d7691c3a420cc2c09fd06b142430ebb3eef7688112c7e2000ca79c54b4ab73424ea6349478975f87987a
SSDEEP

3072:SwzbCYMaEMBgDwrQhkAaPuJDhjawpyip0T7Ku/VxE1qF9hl7GXB:DC1XzeAaPqdawIq0T7zTRo

Score

7^/10

persistence spyware stealer upx

Malware Config

Targets

- Target
  
  d4a9a0f90082268ebe5b0ecb8c0d8844
- Size
  
  139KB
- MD5
  
  d4a9a0f90082268ebe5b0ecb8c0d8844
- SHA1
  
  f75c068a1849b43ad7aa78a908ddc6b5fc14285f
- SHA256
  
  8f7074c17844d70b1da84771256367d3d088f0d039ee7758475d9bba09b461c5
- SHA512
  
  23be1c3265ed8d4d6c95bdda1c7114ffc0fd1a5501c4d7691c3a420cc2c09fd06b142430ebb3eef7688112c7e2000ca79c54b4ab73424ea6349478975f87987a
- SSDEEP
  
  3072:SwzbCYMaEMBgDwrQhkAaPuJDhjawpyip0T7Ku/VxE1qF9hl7GXB:DC1XzeAaPqdawIq0T7zTRo
Score

7^/10

persistence spyware stealer upx
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealerupx

behavioral2