a6f258f58f0057fe9736f7d5b1e50148634cee01f583d2180d0d6c8dce336d3b | Triage

Sharing

General

Target

a6f258f58f0057fe9736f7d5b1e50148634cee01f583d2180d0d6c8dce336d3b
Size

2.0MB
Sample

240409-a6v7magh96
MD5

b987a085643bffa2bf91a18f0bc21470
SHA1

7ac8938597f779766debf30b04056e27fd94b6d9
SHA256

a6f258f58f0057fe9736f7d5b1e50148634cee01f583d2180d0d6c8dce336d3b
SHA512

274cbefe5a2306cc6e62b8dbc6d82820787a6f98cc4652da74a0937500b59e8f521daaac3081596bd1df34b68ab57f3821aeea048e19a8900efbe9b0de5e483c
SSDEEP

49152:5HXEzoyAkfjQcrqa6YqJMXarizjr4uDlkw39VOEb:IoyHfjQcrNoMXaG/rDkwX

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  a6f258f58f0057fe9736f7d5b1e50148634cee01f583d2180d0d6c8dce336d3b
- Size
  
  2.0MB
- MD5
  
  b987a085643bffa2bf91a18f0bc21470
- SHA1
  
  7ac8938597f779766debf30b04056e27fd94b6d9
- SHA256
  
  a6f258f58f0057fe9736f7d5b1e50148634cee01f583d2180d0d6c8dce336d3b
- SHA512
  
  274cbefe5a2306cc6e62b8dbc6d82820787a6f98cc4652da74a0937500b59e8f521daaac3081596bd1df34b68ab57f3821aeea048e19a8900efbe9b0de5e483c
- SSDEEP
  
  49152:5HXEzoyAkfjQcrqa6YqJMXarizjr4uDlkw39VOEb:IoyHfjQcrNoMXaG/rDkwX
Score

9^/10

persistence spyware stealer
- Detects executables containing possible sandbox analysis VM usernames
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer