5ffde52bf550fc2091468f20c4eb44162c6d4eadb6ec9388f6fb0b6de6d764d9 | Triage

Sharing

General

Target

5ffde52bf550fc2091468f20c4eb44162c6d4eadb6ec9388f6fb0b6de6d764d9
Size

63KB
Sample

240428-xx2dlseg89
MD5

92030f53ded78fa160cdfac717fd6ced
SHA1

c0fe36f5e43615d60afd663ac2763fbf46b19ea0
SHA256

5ffde52bf550fc2091468f20c4eb44162c6d4eadb6ec9388f6fb0b6de6d764d9
SHA512

5ac4f1ea9f76a50e8ad40347956a83882fa7d7f0c7a247a1b0afcb82bdc2ca64151b11490db766ded74b05b01f1fa8aaad552c45d79202a57858f8ee2ede3e16
SSDEEP

1536:/qbSe+Zk78NR3dN5nPpq9khDRGadegghOgmgk:/3e+a+3dN5g9k9dehhOgo

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  5ffde52bf550fc2091468f20c4eb44162c6d4eadb6ec9388f6fb0b6de6d764d9
- Size
  
  63KB
- MD5
  
  92030f53ded78fa160cdfac717fd6ced
- SHA1
  
  c0fe36f5e43615d60afd663ac2763fbf46b19ea0
- SHA256
  
  5ffde52bf550fc2091468f20c4eb44162c6d4eadb6ec9388f6fb0b6de6d764d9
- SHA512
  
  5ac4f1ea9f76a50e8ad40347956a83882fa7d7f0c7a247a1b0afcb82bdc2ca64151b11490db766ded74b05b01f1fa8aaad552c45d79202a57858f8ee2ede3e16
- SSDEEP
  
  1536:/qbSe+Zk78NR3dN5nPpq9khDRGadegghOgmgk:/3e+a+3dN5g9k9dehhOgo
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2