9a48b39f2a626c419579008ddc72b93c58cdd205f99d670f9dbf4ffd641f6df7 | Triage

Sharing

General

Target

9a48b39f2a626c419579008ddc72b93c58cdd205f99d670f9dbf4ffd641f6df7
Size

445KB
Sample

240409-114vpadg78
MD5

26ed7231a29bff1733360b535ad1b9da
SHA1

056d973506e71b1c570aa1a19f8a7bbaec1df297
SHA256

9a48b39f2a626c419579008ddc72b93c58cdd205f99d670f9dbf4ffd641f6df7
SHA512

b7037c1bacdd76dc563ffa09c6dcf5ccccb80ef5a20aa3d01559df1f065efc5680e1fd24e34f2b3a8d559e95b34a1216c5feea77f5b0a95b50d72be0d732c896
SSDEEP

12288:oGHasii9B137B9OsFeH6mpcF0H3LSi0vw9+EN98FrsAFXkm:86B7B9OsAH6maQ330vw9HEAAl

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  9a48b39f2a626c419579008ddc72b93c58cdd205f99d670f9dbf4ffd641f6df7
- Size
  
  445KB
- MD5
  
  26ed7231a29bff1733360b535ad1b9da
- SHA1
  
  056d973506e71b1c570aa1a19f8a7bbaec1df297
- SHA256
  
  9a48b39f2a626c419579008ddc72b93c58cdd205f99d670f9dbf4ffd641f6df7
- SHA512
  
  b7037c1bacdd76dc563ffa09c6dcf5ccccb80ef5a20aa3d01559df1f065efc5680e1fd24e34f2b3a8d559e95b34a1216c5feea77f5b0a95b50d72be0d732c896
- SSDEEP
  
  12288:oGHasii9B137B9OsFeH6mpcF0H3LSi0vw9+EN98FrsAFXkm:86B7B9OsAH6maQ330vw9HEAAl
Score

9^/10

persistence spyware stealer
- Detects executables containing possible sandbox analysis VM usernames
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer