b2e3508fd2829c733b30df09324f2e4f48f042ad305c4cad88a554080512839d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CyberLink_Screen_Recorder_Downloader.exe
Size

1.1MB
Sample

240422-p5dzaabe86
MD5

b0bdb27ee3f86dab5390c82bbab401e1
SHA1

7557770c86d4ea16080e28359698f6774be17a4a
SHA256

b2e3508fd2829c733b30df09324f2e4f48f042ad305c4cad88a554080512839d
SHA512

62f5cac76f2863308cca8c7375d5d5f148fd28df6c63f213d573f96ec07d0a5e6c1759f057b7120422a64fe8ffd99f976ae2279b06dd1c5d9d3c08e61ad65654
SSDEEP

24576:oZaAkg3rDFpzoHLuREr7Sc7QYUEMQhvt4Mdnj4coCYHb0YLExS:HQWZ/MWvmMdnUcophuS

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  CyberLink_Screen_Recorder_Downloader.exe
- Size
  
  1.1MB
- MD5
  
  b0bdb27ee3f86dab5390c82bbab401e1
- SHA1
  
  7557770c86d4ea16080e28359698f6774be17a4a
- SHA256
  
  b2e3508fd2829c733b30df09324f2e4f48f042ad305c4cad88a554080512839d
- SHA512
  
  62f5cac76f2863308cca8c7375d5d5f148fd28df6c63f213d573f96ec07d0a5e6c1759f057b7120422a64fe8ffd99f976ae2279b06dd1c5d9d3c08e61ad65654
- SSDEEP
  
  24576:oZaAkg3rDFpzoHLuREr7Sc7QYUEMQhvt4Mdnj4coCYHb0YLExS:HQWZ/MWvmMdnUcophuS
Score

7^/10

discovery spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer