ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411 | Triage

Sharing

General

Target

ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411
Size

577KB
Sample

240409-qdc4cafg55
MD5

5ac4056f9d0b3bd588671434ead1c17f
SHA1

9d3e0e6c41fe202d78ac7adc0c26c0a5d27b5d9c
SHA256

ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411
SHA512

12955c0c491b2f4b5343ba8d64ac9c08eaa77cb5b84929b36fd9efde7e241dd1553d3175fb39d1f4f9a9cb9e1242f501df3943788977fb06b0d30871ba5330d2
SSDEEP

6144:A+aX3LdE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:A+ai7a3iwbihym2g7XO3LWUQfh4Co

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411
- Size
  
  577KB
- MD5
  
  5ac4056f9d0b3bd588671434ead1c17f
- SHA1
  
  9d3e0e6c41fe202d78ac7adc0c26c0a5d27b5d9c
- SHA256
  
  ed3ad6c04b7778bf946fe1a0cea7b00a82542c7cb9687e562741248ea7657411
- SHA512
  
  12955c0c491b2f4b5343ba8d64ac9c08eaa77cb5b84929b36fd9efde7e241dd1553d3175fb39d1f4f9a9cb9e1242f501df3943788977fb06b0d30871ba5330d2
- SSDEEP
  
  6144:A+aX3LdE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:A+ai7a3iwbihym2g7XO3LWUQfh4Co
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2