d4d3e1c379feab2bad3baf54966fec8100bcc12d80df990a777418859121569a | Triage

Sharing

General

Target

d4d3e1c379feab2bad3baf54966fec8100bcc12d80df990a777418859121569a
Size

3.6MB
Sample

240319-ly3ghsgh79
MD5

29d788614176c36167d75bc7d2cddc46
SHA1

b74df108a16ee27f9f59f2c9c2b0186ff0341b15
SHA256

d4d3e1c379feab2bad3baf54966fec8100bcc12d80df990a777418859121569a
SHA512

7fb350077c5e6951c6e38785616851c49e3f9e6b1bedd0b36d8dabeabfa0165f12893a7ffd8e7e83c1814968ee3b3ecd0e0de2c546a8bb153f0aeee78438c7f9
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8:sxX7QnxrloE5dpUp4bVz8

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  d4d3e1c379feab2bad3baf54966fec8100bcc12d80df990a777418859121569a
- Size
  
  3.6MB
- MD5
  
  29d788614176c36167d75bc7d2cddc46
- SHA1
  
  b74df108a16ee27f9f59f2c9c2b0186ff0341b15
- SHA256
  
  d4d3e1c379feab2bad3baf54966fec8100bcc12d80df990a777418859121569a
- SHA512
  
  7fb350077c5e6951c6e38785616851c49e3f9e6b1bedd0b36d8dabeabfa0165f12893a7ffd8e7e83c1814968ee3b3ecd0e0de2c546a8bb153f0aeee78438c7f9
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8:sxX7QnxrloE5dpUp4bVz8
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer