70923a86d9482fc8ab640907e0d47af575c597925fdb599ac10cbc1075ce1d04 | Triage

Sharing

General

Target

70923a86d9482fc8ab640907e0d47af575c597925fdb599ac10cbc1075ce1d04
Size

3.0MB
Sample

240420-29vh2sda5y
MD5

be2234c150990775e1c873e7e6616739
SHA1

83730d07f202de46c71210f23bab03b09a537179
SHA256

70923a86d9482fc8ab640907e0d47af575c597925fdb599ac10cbc1075ce1d04
SHA512

b92fa0345044253e5cb9d8f8e2eeadd48a293a43343b8622258bd1efe9e700d15c764ea2fc4c55ea1230a9a58cc1273a9abbf94ea9fd83e6b1d989cd5c666279
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bSqz8b6LNX:sxX7QnxrloE5dpUpEbVz8eLF

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  70923a86d9482fc8ab640907e0d47af575c597925fdb599ac10cbc1075ce1d04
- Size
  
  3.0MB
- MD5
  
  be2234c150990775e1c873e7e6616739
- SHA1
  
  83730d07f202de46c71210f23bab03b09a537179
- SHA256
  
  70923a86d9482fc8ab640907e0d47af575c597925fdb599ac10cbc1075ce1d04
- SHA512
  
  b92fa0345044253e5cb9d8f8e2eeadd48a293a43343b8622258bd1efe9e700d15c764ea2fc4c55ea1230a9a58cc1273a9abbf94ea9fd83e6b1d989cd5c666279
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bSqz8b6LNX:sxX7QnxrloE5dpUpEbVz8eLF
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer