39058ed40edb3f306fb6b5dc609088c545d581b8015e496ca57cb13e10876a20 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39058ed40edb3f306fb6b5dc609088c545d581b8015e496ca57cb13e10876a20
Size

2.6MB
Sample

240422-zq3zzagc6x
MD5

cf89246098350850975b3e7c3efc920e
SHA1

816676018f64aa91e553a959b2dea3aeb31b437d
SHA256

39058ed40edb3f306fb6b5dc609088c545d581b8015e496ca57cb13e10876a20
SHA512

5eddd5e836ad68b2f0ad4177daec87d5d1be358155c823593f8217edbb414d4633b4b9a301011c2ed3c20178b121106aa30dc8c09da1c9be6d548df53fc65a84
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bS:sxX7QnxrloE5dpUpXb

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  39058ed40edb3f306fb6b5dc609088c545d581b8015e496ca57cb13e10876a20
- Size
  
  2.6MB
- MD5
  
  cf89246098350850975b3e7c3efc920e
- SHA1
  
  816676018f64aa91e553a959b2dea3aeb31b437d
- SHA256
  
  39058ed40edb3f306fb6b5dc609088c545d581b8015e496ca57cb13e10876a20
- SHA512
  
  5eddd5e836ad68b2f0ad4177daec87d5d1be358155c823593f8217edbb414d4633b4b9a301011c2ed3c20178b121106aa30dc8c09da1c9be6d548df53fc65a84
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bS:sxX7QnxrloE5dpUpXb
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer