537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479 | Triage

Sharing

General

Target

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479
Size

47KB
Sample

240428-rkc8cshg81
MD5

71ee47f249e24c195d23e02d30915fb1
SHA1

cee911d55fafa45f87cd0784912ba2d376921b9b
SHA256

537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479
SHA512

9110164c92b8188e48dbaf92dda7a78e9bca618fa94a7436c3b4a4a5ae43c87af54b49f223a010d7d5db7049951ae4fb832ec2c6d511c9c470f6a0e308cc96f4
SSDEEP

768:/IPcTO5RroZJ76739sBWsNscWlM3dN9N3ZjfPPuWQ3655Kv1X/qY1MSd:/wSe+Zk78NR3dN5nPuHqaNrFd

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479
- Size
  
  47KB
- MD5
  
  71ee47f249e24c195d23e02d30915fb1
- SHA1
  
  cee911d55fafa45f87cd0784912ba2d376921b9b
- SHA256
  
  537d821ae20091bca9df3b89d52c5f4a5491f9e281d59fcfcdbfb6718d1af479
- SHA512
  
  9110164c92b8188e48dbaf92dda7a78e9bca618fa94a7436c3b4a4a5ae43c87af54b49f223a010d7d5db7049951ae4fb832ec2c6d511c9c470f6a0e308cc96f4
- SSDEEP
  
  768:/IPcTO5RroZJ76739sBWsNscWlM3dN9N3ZjfPPuWQ3655Kv1X/qY1MSd:/wSe+Zk78NR3dN5nPuHqaNrFd
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2