03dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571
Size

264KB
Sample

240421-njat3ahh24
MD5

ab6e14fd3b3b82a74d70dd03d0a8e116
SHA1

e8263c09ed7968ab04e1459ad46041ccdd9ff5e9
SHA256

03dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571
SHA512

851e9288ba102d5eabd34d887b70a883307bce31ccb4c7eeaf2b3010cb6bb9435a9c0261bfdafb4a0bf4046b6bc7928cbfb62599269a9c197ec2f83efaf258e8
SSDEEP

6144:dd+azbRZvTgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:dd+azbv8itXqsTkiR7twRx+gD8PJ

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  03dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571
- Size
  
  264KB
- MD5
  
  ab6e14fd3b3b82a74d70dd03d0a8e116
- SHA1
  
  e8263c09ed7968ab04e1459ad46041ccdd9ff5e9
- SHA256
  
  03dda7016a22dd98411b67875e2fe461c960b068fbcb019579d8392530b41571
- SHA512
  
  851e9288ba102d5eabd34d887b70a883307bce31ccb4c7eeaf2b3010cb6bb9435a9c0261bfdafb4a0bf4046b6bc7928cbfb62599269a9c197ec2f83efaf258e8
- SSDEEP
  
  6144:dd+azbRZvTgiC4bXqsTk90qC1AOb7eswf1Px++fD8PJ:dd+azbv8itXqsTkiR7twRx+gD8PJ
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2