a7535cc65cf2da043e6341419e39e631ecd12a42b355bae0085ff0e4286f08f0 | Triage

Sharing

General

Target

a7535cc65cf2da043e6341419e39e631ecd12a42b355bae0085ff0e4286f08f0
Size

74KB
Sample

240428-rkd5nahd89
MD5

1ebef6208856ca46ef2bf05358f8213d
SHA1

808430e9d05c6512814d9f181583b198dd2ec8c7
SHA256

a7535cc65cf2da043e6341419e39e631ecd12a42b355bae0085ff0e4286f08f0
SHA512

6d0d41b1d3641e4c6057c998ca1561fedfeab5ba7c984e621233ea816c41ec39f2cfa072cffffba06a8fad4b426ce84fd85f141074c511fad1d0f5474afc89c5
SSDEEP

1536:/qbSe+Zk78NR3dN5nPAEToa9D4ZQKbgZi1dst7x9PxQ:/3e+a+3dN5QlZQKbgZi1St7xQ

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  a7535cc65cf2da043e6341419e39e631ecd12a42b355bae0085ff0e4286f08f0
- Size
  
  74KB
- MD5
  
  1ebef6208856ca46ef2bf05358f8213d
- SHA1
  
  808430e9d05c6512814d9f181583b198dd2ec8c7
- SHA256
  
  a7535cc65cf2da043e6341419e39e631ecd12a42b355bae0085ff0e4286f08f0
- SHA512
  
  6d0d41b1d3641e4c6057c998ca1561fedfeab5ba7c984e621233ea816c41ec39f2cfa072cffffba06a8fad4b426ce84fd85f141074c511fad1d0f5474afc89c5
- SSDEEP
  
  1536:/qbSe+Zk78NR3dN5nPAEToa9D4ZQKbgZi1dst7x9PxQ:/3e+a+3dN5QlZQKbgZi1St7xQ
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2