4acf5f55ac39fdc3018dffa08a06eb14f9cbef674117b614665099708ef48ad8 | Triage

Sharing

General

Target

4acf5f55ac39fdc3018dffa08a06eb14f9cbef674117b614665099708ef48ad8
Size

3.1MB
Sample

240420-1n1x9sah32
MD5

15803c877a4255357114d2e3f03ce5d0
SHA1

f436f2f696c179cb3732aadc8c35299aa0e0f537
SHA256

4acf5f55ac39fdc3018dffa08a06eb14f9cbef674117b614665099708ef48ad8
SHA512

835cab2c6d373f639e58af3c3da6d4f2a77d2e842fc73f0ac352941105234e586fff92e1e76df7ba4d3f405b188eff240f3bd74359c25428adb447b36b71f208
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpGbVz8eLFc

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  4acf5f55ac39fdc3018dffa08a06eb14f9cbef674117b614665099708ef48ad8
- Size
  
  3.1MB
- MD5
  
  15803c877a4255357114d2e3f03ce5d0
- SHA1
  
  f436f2f696c179cb3732aadc8c35299aa0e0f537
- SHA256
  
  4acf5f55ac39fdc3018dffa08a06eb14f9cbef674117b614665099708ef48ad8
- SHA512
  
  835cab2c6d373f639e58af3c3da6d4f2a77d2e842fc73f0ac352941105234e586fff92e1e76df7ba4d3f405b188eff240f3bd74359c25428adb447b36b71f208
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpGbVz8eLFc
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer