d3c46ed0a11b477167cc7617b2d03fd6d57ecc48138639f0602d7a0fd17508b9 | Triage

Sharing

General

Target

d3c46ed0a11b477167cc7617b2d03fd6d57ecc48138639f0602d7a0fd17508b9
Size

5.7MB
Sample

240423-pm43ragc52
MD5

7a5bf3160f1f5f8e607b14afc4f263cc
SHA1

d3cc79b8ccbb9cad44793dc12d4db72a3e3e9370
SHA256

d3c46ed0a11b477167cc7617b2d03fd6d57ecc48138639f0602d7a0fd17508b9
SHA512

1299c8c449056327fd67d36cbf1afb98cb5cfccb6addc8ad920134422a770834c5a1d3fec5a6216cf1271f6445220791ceab4e03291d15e6870d1715aa767c62
SSDEEP

49152:kjPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:krKUgTH2M2m9UMpu1QfLczqssnKSk

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  d3c46ed0a11b477167cc7617b2d03fd6d57ecc48138639f0602d7a0fd17508b9
- Size
  
  5.7MB
- MD5
  
  7a5bf3160f1f5f8e607b14afc4f263cc
- SHA1
  
  d3cc79b8ccbb9cad44793dc12d4db72a3e3e9370
- SHA256
  
  d3c46ed0a11b477167cc7617b2d03fd6d57ecc48138639f0602d7a0fd17508b9
- SHA512
  
  1299c8c449056327fd67d36cbf1afb98cb5cfccb6addc8ad920134422a770834c5a1d3fec5a6216cf1271f6445220791ceab4e03291d15e6870d1715aa767c62
- SSDEEP
  
  49152:kjPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:krKUgTH2M2m9UMpu1QfLczqssnKSk
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2