4c03190d656a8ea9dd4ca83e2ed1d5b924f4bb6a4e3785644a3b0e8f59a665e0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c03190d656a8ea9dd4ca83e2ed1d5b924f4bb6a4e3785644a3b0e8f59a665e0
Size

3.0MB
Sample

240424-s8qc9scf93
MD5

2b58b1483d9593fdd4f7c349fae42c7e
SHA1

787dcd26c1583a11af44480a5b452809b91c0828
SHA256

4c03190d656a8ea9dd4ca83e2ed1d5b924f4bb6a4e3785644a3b0e8f59a665e0
SHA512

46d18f918afc982fc37ed092fe3f9d9504a075dba557bd896dddaaca68a1fbc628348855ad399e811fde1248b22813a69e8cd53eda4cdc35c8c4346b4bdad4a4
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8:sxX7QnxrloE5dpUpsbVz8

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  4c03190d656a8ea9dd4ca83e2ed1d5b924f4bb6a4e3785644a3b0e8f59a665e0
- Size
  
  3.0MB
- MD5
  
  2b58b1483d9593fdd4f7c349fae42c7e
- SHA1
  
  787dcd26c1583a11af44480a5b452809b91c0828
- SHA256
  
  4c03190d656a8ea9dd4ca83e2ed1d5b924f4bb6a4e3785644a3b0e8f59a665e0
- SHA512
  
  46d18f918afc982fc37ed092fe3f9d9504a075dba557bd896dddaaca68a1fbc628348855ad399e811fde1248b22813a69e8cd53eda4cdc35c8c4346b4bdad4a4
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8:sxX7QnxrloE5dpUpsbVz8
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer